General
-
Target
1245c85d7191eb29065c9508161e81241c7017077f4e005971ea7bede6c6a5e4
-
Size
1.3MB
-
Sample
230202-p9pataad4s
-
MD5
e4e52682f5dac3b7c0e008980eef9d55
-
SHA1
1b2dd7f3e1d8b88812699b5ce746f14125d5273d
-
SHA256
1245c85d7191eb29065c9508161e81241c7017077f4e005971ea7bede6c6a5e4
-
SHA512
e7d1a10e7526568dbc14c354152dc769060f0a59616da5998f830a9f90555b0035badff7d96f9bd5705b20a68bebb3f17b6bd4a3360dc5b25b37a6eea9e7f655
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Behavioral task
behavioral1
Sample
1245c85d7191eb29065c9508161e81241c7017077f4e005971ea7bede6c6a5e4.exe
Resource
win10v2004-20221111-en
Malware Config
Targets
-
-
Target
1245c85d7191eb29065c9508161e81241c7017077f4e005971ea7bede6c6a5e4
-
Size
1.3MB
-
MD5
e4e52682f5dac3b7c0e008980eef9d55
-
SHA1
1b2dd7f3e1d8b88812699b5ce746f14125d5273d
-
SHA256
1245c85d7191eb29065c9508161e81241c7017077f4e005971ea7bede6c6a5e4
-
SHA512
e7d1a10e7526568dbc14c354152dc769060f0a59616da5998f830a9f90555b0035badff7d96f9bd5705b20a68bebb3f17b6bd4a3360dc5b25b37a6eea9e7f655
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Legitimate hosting services abused for malware hosting/C2
-