General
-
Target
9cc267cf8df0c2cbf0c6f8908b1db252826897a1ac0c8d26d622d5d85c6d06d9
-
Size
1.3MB
-
Sample
230202-vg7jksba55
-
MD5
84aee4f133d547f9b5f5d82a75dcf059
-
SHA1
7e35bbc3d105235c6b5db4aae909f0a68c76bcee
-
SHA256
9cc267cf8df0c2cbf0c6f8908b1db252826897a1ac0c8d26d622d5d85c6d06d9
-
SHA512
819068abf3bf00e94d3d9d4f4ee53787593939514cdcff22293655f8816d1eb755bb8e9dfc55038cfa950a776543f7d0245b5a46dae7dad43170c392cb5f48ef
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Behavioral task
behavioral1
Sample
9cc267cf8df0c2cbf0c6f8908b1db252826897a1ac0c8d26d622d5d85c6d06d9.exe
Resource
win10v2004-20221111-en
Malware Config
Targets
-
-
Target
9cc267cf8df0c2cbf0c6f8908b1db252826897a1ac0c8d26d622d5d85c6d06d9
-
Size
1.3MB
-
MD5
84aee4f133d547f9b5f5d82a75dcf059
-
SHA1
7e35bbc3d105235c6b5db4aae909f0a68c76bcee
-
SHA256
9cc267cf8df0c2cbf0c6f8908b1db252826897a1ac0c8d26d622d5d85c6d06d9
-
SHA512
819068abf3bf00e94d3d9d4f4ee53787593939514cdcff22293655f8816d1eb755bb8e9dfc55038cfa950a776543f7d0245b5a46dae7dad43170c392cb5f48ef
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-