General
-
Target
09e9cefb358c55b03e898488f8d052df.bin
-
Size
7.4MB
-
Sample
230127-prnassad69
-
MD5
b4e0d118e776938f6d0b9eed4c0b2fc4
-
SHA1
6d097e6aef7a63c68aa0b37f1b20b5b106bd4115
-
SHA256
b2629e2580c4e27c632d0517771a61d3ca9e1e4c6725f4ea5d48a102da4c043c
-
SHA512
0258feff5fbbd4bcdc3a5a1e8ed3a4f1f05aa7bf91f11b74f2ab7b94a67cf1aaefe2dc4ba7bf02edeaac74906384338b64630acf3c8327696b3a88bb37840eab
-
SSDEEP
196608:lXTlG3LgKuh8lmO5kkF4i9nSjHksCN789Usj+Kqb:VZG3uhEei9nIO8OGK
Behavioral task
behavioral1
Sample
c98e35ff05689705117dbb7e36e58f1237f08df30637132d6e2106db1bddff77.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c98e35ff05689705117dbb7e36e58f1237f08df30637132d6e2106db1bddff77.exe
Resource
win10v2004-20221111-en
Malware Config
Targets
-
-
Target
c98e35ff05689705117dbb7e36e58f1237f08df30637132d6e2106db1bddff77.exe
-
Size
7.8MB
-
MD5
09e9cefb358c55b03e898488f8d052df
-
SHA1
4e8a3b17d01b386e0e1442ae05d885168c1206e4
-
SHA256
c98e35ff05689705117dbb7e36e58f1237f08df30637132d6e2106db1bddff77
-
SHA512
8f80435e4f5e82465a98327c915c689ad97b66e822397b82d0b70e9d45d4158c373b33b92cb06cfefc4068e156ac0aa7012ade22b07552cbe911e41b6a44fa59
-
SSDEEP
196608:W5YhQECsXDjpf3ZkJMFEAJX8JvC/UcwCK:8YhQECENZkcJVw
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-