General
-
Target
5b0a69d70a6d2a3f3def61c3af581755daf3d8e93b742f80f73a59c61b9833af
-
Size
1.3MB
-
Sample
230202-pq86waac3t
-
MD5
db97d1279e082843c8de25e67b5e0a2f
-
SHA1
ab6055c6033f39aeaf4f0e639483173dc6836574
-
SHA256
5b0a69d70a6d2a3f3def61c3af581755daf3d8e93b742f80f73a59c61b9833af
-
SHA512
06a0dc5833ee0d08bcdda2c444dd4e2e1f0b71b7a4313457462877530177dc3934883fc4e3932fe6780510065c9bb0239cfcf12ffb7a711df22ce938e51e7d7b
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Behavioral task
behavioral1
Sample
5b0a69d70a6d2a3f3def61c3af581755daf3d8e93b742f80f73a59c61b9833af.exe
Resource
win10v2004-20221111-en
Malware Config
Targets
-
-
Target
5b0a69d70a6d2a3f3def61c3af581755daf3d8e93b742f80f73a59c61b9833af
-
Size
1.3MB
-
MD5
db97d1279e082843c8de25e67b5e0a2f
-
SHA1
ab6055c6033f39aeaf4f0e639483173dc6836574
-
SHA256
5b0a69d70a6d2a3f3def61c3af581755daf3d8e93b742f80f73a59c61b9833af
-
SHA512
06a0dc5833ee0d08bcdda2c444dd4e2e1f0b71b7a4313457462877530177dc3934883fc4e3932fe6780510065c9bb0239cfcf12ffb7a711df22ce938e51e7d7b
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Legitimate hosting services abused for malware hosting/C2
-