General
-
Target
a8490ec288042a275cc34152e7e38e58.bin
-
Size
1.3MB
-
Sample
230130-x2ltqacb23
-
MD5
9022fdf5c386a4d885f8a60d2471eee0
-
SHA1
415a2a74468c375b030f49eb4068cd36ebf64a3e
-
SHA256
477803b49dfa3b686c7eee0b25448d71e00ffd3bdabcd3d590cda750bb67c9df
-
SHA512
9f4765a4c9eb5e53c8dbd9b9521144ca291b6809a5dec0ea2836fd9d34afac4600edce82b6e9ddd357119bb0640da96828f1ac81c39b3aa6f3b8ca0970c1eff4
-
SSDEEP
24576:weZGG5mB9SxMXsRsGcZfLyArLD+WvKGAXideQ3FuKqvF5u:dODkMz5LyAKWEieqOHu
Malware Config
Targets
-
-
Target
878ca94c0a87add5a199309ba3bbb222e7cfe76f118b3f9e00f82a11c5a55682.exe
-
Size
1.7MB
-
MD5
a8490ec288042a275cc34152e7e38e58
-
SHA1
55d45e8d0818b6549104b8656462125cb1ef9d46
-
SHA256
878ca94c0a87add5a199309ba3bbb222e7cfe76f118b3f9e00f82a11c5a55682
-
SHA512
9cae5d7b7fb1c1919849c9ff66cbdf0c709021da6147e360416c7795bd621afb4a6880ad91abce55594fbc56725dc165a7c8b4d6fca7c50c4ba60294dd971a8f
-
SSDEEP
24576:oVvACGOfLOiwzatXNbn11rHfq+XwXwIfBnshZWU/8WT1HNg9o71rRS:oVvACGpAj11hgpJs/FUW89SV
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Modifies WinLogon for persistence
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
UAC bypass
-
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-