General
-
Target
6a292bf395db74996b684381c80b726f001e755a548c21581447ffe0b159fdb3
-
Size
1.3MB
-
Sample
230202-wk9c1scb5z
-
MD5
8befa2e572221584522785114d7e336b
-
SHA1
e4c0b300b972cefdc5e253c0404fe0746d077073
-
SHA256
6a292bf395db74996b684381c80b726f001e755a548c21581447ffe0b159fdb3
-
SHA512
889890deda6b67869f3b710109bb8ec24a7527c4bd07b6e60fcfbd79c3a8e31faeee94e35b9cc1515b47b4cd736fee4ab2f44a2168b1c867e61bcb14cee4468d
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Behavioral task
behavioral1
Sample
6a292bf395db74996b684381c80b726f001e755a548c21581447ffe0b159fdb3.exe
Resource
win10v2004-20221111-en
Malware Config
Targets
-
-
Target
6a292bf395db74996b684381c80b726f001e755a548c21581447ffe0b159fdb3
-
Size
1.3MB
-
MD5
8befa2e572221584522785114d7e336b
-
SHA1
e4c0b300b972cefdc5e253c0404fe0746d077073
-
SHA256
6a292bf395db74996b684381c80b726f001e755a548c21581447ffe0b159fdb3
-
SHA512
889890deda6b67869f3b710109bb8ec24a7527c4bd07b6e60fcfbd79c3a8e31faeee94e35b9cc1515b47b4cd736fee4ab2f44a2168b1c867e61bcb14cee4468d
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-