General
-
Target
bbd5709ac40896d243f619941d4789c3.exe
-
Size
1.4MB
-
Sample
230126-lzhhqsdc49
-
MD5
bbd5709ac40896d243f619941d4789c3
-
SHA1
d6e45ca38ffcb71b1df4fdd51c628ffdc58ab7b0
-
SHA256
d2ac899a907641ad38d3d535723be9fd3f581590bb461c93f30d1d2dc5706087
-
SHA512
61d76a75f6143acf0e15b6b6f2b9d810e71b96a32c25f3083476b1cf23bc4d0a04c609115b7def17a91872134f17aa068a484d97306eb2fdd046d97df297eb92
-
SSDEEP
24576:sWcUeg8DqSBzKMC5n9yjh7VU6KSQBVh5iIq0YLCTayC7NR:PNepqeGMCG9nKLPhIIqjGWyC5
Behavioral task
behavioral1
Sample
bbd5709ac40896d243f619941d4789c3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bbd5709ac40896d243f619941d4789c3.exe
Resource
win10v2004-20221111-en
Malware Config
Targets
-
-
Target
bbd5709ac40896d243f619941d4789c3.exe
-
Size
1.4MB
-
MD5
bbd5709ac40896d243f619941d4789c3
-
SHA1
d6e45ca38ffcb71b1df4fdd51c628ffdc58ab7b0
-
SHA256
d2ac899a907641ad38d3d535723be9fd3f581590bb461c93f30d1d2dc5706087
-
SHA512
61d76a75f6143acf0e15b6b6f2b9d810e71b96a32c25f3083476b1cf23bc4d0a04c609115b7def17a91872134f17aa068a484d97306eb2fdd046d97df297eb92
-
SSDEEP
24576:sWcUeg8DqSBzKMC5n9yjh7VU6KSQBVh5iIq0YLCTayC7NR:PNepqeGMCG9nKLPhIIqjGWyC5
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-