Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
7ab0f841170882abb0ddac1c429e59c13e5a73c903408560bd2b2fbca4fe257d
-
Size
1.3MB
-
Sample
221103-mw4ggabfem
-
MD5
7dc30255b9c525bfb0e1a1036eb7a9b0
-
SHA1
3a3f2cba723fee9de8df596791b08a79dccf218d
-
SHA256
7ab0f841170882abb0ddac1c429e59c13e5a73c903408560bd2b2fbca4fe257d
-
SHA512
63c71d4a0dd4830bb990362c013b1db2f9ff9dda6a3494a5fd5209c47712b4a580daa27acbe4cd360fdfd921d280369bc57ad040a3b060716164ad1b16755048
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Behavioral task
behavioral1
Sample
7ab0f841170882abb0ddac1c429e59c13e5a73c903408560bd2b2fbca4fe257d.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
7ab0f841170882abb0ddac1c429e59c13e5a73c903408560bd2b2fbca4fe257d
-
Size
1.3MB
-
MD5
7dc30255b9c525bfb0e1a1036eb7a9b0
-
SHA1
3a3f2cba723fee9de8df596791b08a79dccf218d
-
SHA256
7ab0f841170882abb0ddac1c429e59c13e5a73c903408560bd2b2fbca4fe257d
-
SHA512
63c71d4a0dd4830bb990362c013b1db2f9ff9dda6a3494a5fd5209c47712b4a580daa27acbe4cd360fdfd921d280369bc57ad040a3b060716164ad1b16755048
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Legitimate hosting services abused for malware hosting/C2
-