General
-
Target
limalt.exe
-
Size
2.0MB
-
Sample
230201-n65yqada98
-
MD5
8468c0223b7665174d19866d33ae9731
-
SHA1
b261b25063f61b7194310d62912596df732ebbb7
-
SHA256
915f9f512ca5182e905b1ae904c984b30f5039884d1835d91248b0e6b19f0f83
-
SHA512
77397cc18ba208256e9fc4ebd182a197f6fc2f71e17ae737b0ab3bfa8c09d3da6a3ae30076a1bfaea9bd4889402f5e897f3b751cf86e8e12fd59f85f48613eb6
-
SSDEEP
49152:ubA3j3+gYXZTD1VXUqzX7VwjvMoh1IFyuyigWnMzm6sDBKvK:ubdTHUxUoh1IF9gl2x
Behavioral task
behavioral1
Sample
limalt.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
limalt.exe
-
Size
2.0MB
-
MD5
8468c0223b7665174d19866d33ae9731
-
SHA1
b261b25063f61b7194310d62912596df732ebbb7
-
SHA256
915f9f512ca5182e905b1ae904c984b30f5039884d1835d91248b0e6b19f0f83
-
SHA512
77397cc18ba208256e9fc4ebd182a197f6fc2f71e17ae737b0ab3bfa8c09d3da6a3ae30076a1bfaea9bd4889402f5e897f3b751cf86e8e12fd59f85f48613eb6
-
SSDEEP
49152:ubA3j3+gYXZTD1VXUqzX7VwjvMoh1IFyuyigWnMzm6sDBKvK:ubdTHUxUoh1IF9gl2x
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-