General
-
Target
a49bb563b97d150903cfb0bbdbae26aee89047c2efa09e9a75846f0aeeafeafa
-
Size
1.3MB
-
Sample
221102-pa8v6scdgn
-
MD5
55ea649f27d20eaf0b90304d103f7b88
-
SHA1
6f73ed031618fb22058eed15cb7c155d33ba27e3
-
SHA256
a49bb563b97d150903cfb0bbdbae26aee89047c2efa09e9a75846f0aeeafeafa
-
SHA512
a19b6f83b4eee74b240783a4c56c4dd03122d2baa08ee3fc3e14dca3ef859ba8c792dc1df58d3b29357fdf3a3345b29877369210da1d4f109e861eea83629e00
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Behavioral task
behavioral1
Sample
a49bb563b97d150903cfb0bbdbae26aee89047c2efa09e9a75846f0aeeafeafa.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
a49bb563b97d150903cfb0bbdbae26aee89047c2efa09e9a75846f0aeeafeafa
-
Size
1.3MB
-
MD5
55ea649f27d20eaf0b90304d103f7b88
-
SHA1
6f73ed031618fb22058eed15cb7c155d33ba27e3
-
SHA256
a49bb563b97d150903cfb0bbdbae26aee89047c2efa09e9a75846f0aeeafeafa
-
SHA512
a19b6f83b4eee74b240783a4c56c4dd03122d2baa08ee3fc3e14dca3ef859ba8c792dc1df58d3b29357fdf3a3345b29877369210da1d4f109e861eea83629e00
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Legitimate hosting services abused for malware hosting/C2
-