General
-
Target
6588c7c8664688456da3bc21394eac31988d28018f76da7442af17eb2254124d
-
Size
1.3MB
-
Sample
230202-x8g44saa61
-
MD5
97b1e5e415d3b1d67a7b8533319cdb08
-
SHA1
aa87a689362116787eadfca857d9cd6f6cf0751f
-
SHA256
6588c7c8664688456da3bc21394eac31988d28018f76da7442af17eb2254124d
-
SHA512
cb6d23588658168cc8273b0b443959f9be92d7a21b67c4c7a4ef59f247176413664ccaad1c44c23b33f08e07f9daa8883f05501b9052470497319b9bad1f8ea5
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Behavioral task
behavioral1
Sample
6588c7c8664688456da3bc21394eac31988d28018f76da7442af17eb2254124d.exe
Resource
win10v2004-20221111-en
Malware Config
Targets
-
-
Target
6588c7c8664688456da3bc21394eac31988d28018f76da7442af17eb2254124d
-
Size
1.3MB
-
MD5
97b1e5e415d3b1d67a7b8533319cdb08
-
SHA1
aa87a689362116787eadfca857d9cd6f6cf0751f
-
SHA256
6588c7c8664688456da3bc21394eac31988d28018f76da7442af17eb2254124d
-
SHA512
cb6d23588658168cc8273b0b443959f9be92d7a21b67c4c7a4ef59f247176413664ccaad1c44c23b33f08e07f9daa8883f05501b9052470497319b9bad1f8ea5
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-