General
-
Target
543affcfc0188c85d0f55630d7144ce2632369f549731ef10979faf74c450fbd
-
Size
1.3MB
-
Sample
230202-pqebhagc29
-
MD5
76ff81679168b8dfcc0ff5ef20c6d19e
-
SHA1
0f857cbe340295218548036c169b51a4e5c66ea2
-
SHA256
543affcfc0188c85d0f55630d7144ce2632369f549731ef10979faf74c450fbd
-
SHA512
4cab2a4f592444dcb128d7d79aaae101bc6b0d96a35a5d447921e2ba42cd864b679362eb6f75e9acd2efe2c2a44d0c64b22aeceb3c4c3361c9521cf762767b37
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Behavioral task
behavioral1
Sample
543affcfc0188c85d0f55630d7144ce2632369f549731ef10979faf74c450fbd.exe
Resource
win10v2004-20221111-en
Malware Config
Targets
-
-
Target
543affcfc0188c85d0f55630d7144ce2632369f549731ef10979faf74c450fbd
-
Size
1.3MB
-
MD5
76ff81679168b8dfcc0ff5ef20c6d19e
-
SHA1
0f857cbe340295218548036c169b51a4e5c66ea2
-
SHA256
543affcfc0188c85d0f55630d7144ce2632369f549731ef10979faf74c450fbd
-
SHA512
4cab2a4f592444dcb128d7d79aaae101bc6b0d96a35a5d447921e2ba42cd864b679362eb6f75e9acd2efe2c2a44d0c64b22aeceb3c4c3361c9521cf762767b37
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Legitimate hosting services abused for malware hosting/C2
-