General
-
Target
81b691c6c42b49ed8c8b4eb734361564474bede04e4ff7e7c7bb2a79bd3767d7
-
Size
1.3MB
-
Sample
230202-rs412sha3z
-
MD5
5ea9e2accea28d13b4799740edb521b9
-
SHA1
96f2f3ae06ad161b3a1afaae60c40b163d45b3a7
-
SHA256
81b691c6c42b49ed8c8b4eb734361564474bede04e4ff7e7c7bb2a79bd3767d7
-
SHA512
a067beb564ff9950a3a24786507f139ef9e33680b1f39f755580de34661e8dec02e7ddf351e6c0180c4ab6930c1b96d0eec5d24f96776aeed36c450258a1adc9
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Behavioral task
behavioral1
Sample
81b691c6c42b49ed8c8b4eb734361564474bede04e4ff7e7c7bb2a79bd3767d7.exe
Resource
win10v2004-20221111-en
Malware Config
Targets
-
-
Target
81b691c6c42b49ed8c8b4eb734361564474bede04e4ff7e7c7bb2a79bd3767d7
-
Size
1.3MB
-
MD5
5ea9e2accea28d13b4799740edb521b9
-
SHA1
96f2f3ae06ad161b3a1afaae60c40b163d45b3a7
-
SHA256
81b691c6c42b49ed8c8b4eb734361564474bede04e4ff7e7c7bb2a79bd3767d7
-
SHA512
a067beb564ff9950a3a24786507f139ef9e33680b1f39f755580de34661e8dec02e7ddf351e6c0180c4ab6930c1b96d0eec5d24f96776aeed36c450258a1adc9
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Legitimate hosting services abused for malware hosting/C2
-