General
-
Target
94047edaded3aa81d4a80667e2ad84e72aab1e7be423e4b86dcc4e4a834ad7b5
-
Size
1.3MB
-
Sample
230202-vjld5aee4z
-
MD5
f47dd4cd7be3de6f7a037d662750a8a0
-
SHA1
1b4423c05377e47be161e68820bea3136ecc300f
-
SHA256
94047edaded3aa81d4a80667e2ad84e72aab1e7be423e4b86dcc4e4a834ad7b5
-
SHA512
310706145a41dc23b6680247c30f340463ba887ae0df1e7687c3f70ffda7b5beb222aa804c9c538f4f90ab59599812ba13e292071962914755d5d612eece3b09
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Behavioral task
behavioral1
Sample
94047edaded3aa81d4a80667e2ad84e72aab1e7be423e4b86dcc4e4a834ad7b5.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
94047edaded3aa81d4a80667e2ad84e72aab1e7be423e4b86dcc4e4a834ad7b5
-
Size
1.3MB
-
MD5
f47dd4cd7be3de6f7a037d662750a8a0
-
SHA1
1b4423c05377e47be161e68820bea3136ecc300f
-
SHA256
94047edaded3aa81d4a80667e2ad84e72aab1e7be423e4b86dcc4e4a834ad7b5
-
SHA512
310706145a41dc23b6680247c30f340463ba887ae0df1e7687c3f70ffda7b5beb222aa804c9c538f4f90ab59599812ba13e292071962914755d5d612eece3b09
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-