Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
f80360c8e6a06e5920975258ae6a151c0a95b62d7871bfbcd5e2e623b055ef8a
-
Size
1.3MB
-
Sample
221101-r5rlgscgc2
-
MD5
9879ed2646fa43b83671d9a747206465
-
SHA1
2f7247087e2de1f64615e943c9fed40ef66759a0
-
SHA256
f80360c8e6a06e5920975258ae6a151c0a95b62d7871bfbcd5e2e623b055ef8a
-
SHA512
61a600be9dc728e0d5af0560a073af6b0a72fc12ad024cbaaa576d90c7b70b41256ec551ef631d76b9c4cb3394a0f971cc1f97a7c962a47ade5df28eaaa5ad43
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Behavioral task
behavioral1
Sample
f80360c8e6a06e5920975258ae6a151c0a95b62d7871bfbcd5e2e623b055ef8a.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
f80360c8e6a06e5920975258ae6a151c0a95b62d7871bfbcd5e2e623b055ef8a
-
Size
1.3MB
-
MD5
9879ed2646fa43b83671d9a747206465
-
SHA1
2f7247087e2de1f64615e943c9fed40ef66759a0
-
SHA256
f80360c8e6a06e5920975258ae6a151c0a95b62d7871bfbcd5e2e623b055ef8a
-
SHA512
61a600be9dc728e0d5af0560a073af6b0a72fc12ad024cbaaa576d90c7b70b41256ec551ef631d76b9c4cb3394a0f971cc1f97a7c962a47ade5df28eaaa5ad43
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Legitimate hosting services abused for malware hosting/C2
-