General
-
Target
b3ae1056ca2e09e2fe5fdb334b4fcefad475d0fff7abe60e3107df1ad398ca54
-
Size
1.3MB
-
Sample
230202-sg67pscf81
-
MD5
cffb699ab74c006681aa7de5241801d3
-
SHA1
904246a101a7bba7a478030a3aac1e40e2d56eab
-
SHA256
b3ae1056ca2e09e2fe5fdb334b4fcefad475d0fff7abe60e3107df1ad398ca54
-
SHA512
27d06da54a36b1fab17ea94106d3ec2a0e54e3bafcd40ce76dba0c0b0e6944519f5b81135738ca9132d0ee65bd666cc922b2cdcbfa9169bcaed6c70a3bf2f5d7
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Behavioral task
behavioral1
Sample
b3ae1056ca2e09e2fe5fdb334b4fcefad475d0fff7abe60e3107df1ad398ca54.exe
Resource
win10-20220812-en
Malware Config
Targets
-
-
Target
b3ae1056ca2e09e2fe5fdb334b4fcefad475d0fff7abe60e3107df1ad398ca54
-
Size
1.3MB
-
MD5
cffb699ab74c006681aa7de5241801d3
-
SHA1
904246a101a7bba7a478030a3aac1e40e2d56eab
-
SHA256
b3ae1056ca2e09e2fe5fdb334b4fcefad475d0fff7abe60e3107df1ad398ca54
-
SHA512
27d06da54a36b1fab17ea94106d3ec2a0e54e3bafcd40ce76dba0c0b0e6944519f5b81135738ca9132d0ee65bd666cc922b2cdcbfa9169bcaed6c70a3bf2f5d7
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-