Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2d7ef95d0af8974a462e2c2ebb74c259c6a45e6972c0872bc540c57d62d1ad99
-
Size
1.3MB
-
Sample
230203-gnk29seh7s
-
MD5
562f9e01d40573cf7a24dbc479ca51c7
-
SHA1
41a3a675b7d499ece87e8ade91b5a38cf045058a
-
SHA256
2d7ef95d0af8974a462e2c2ebb74c259c6a45e6972c0872bc540c57d62d1ad99
-
SHA512
f2a6ee7b087465ad664b96b18a32564074851dc2347852454bf4f7e0d63c59e8b8550d23370228e0ae7058385a44707f140b589fec13f90d084f160bedefe25a
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Behavioral task
behavioral1
Sample
2d7ef95d0af8974a462e2c2ebb74c259c6a45e6972c0872bc540c57d62d1ad99.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
2d7ef95d0af8974a462e2c2ebb74c259c6a45e6972c0872bc540c57d62d1ad99
-
Size
1.3MB
-
MD5
562f9e01d40573cf7a24dbc479ca51c7
-
SHA1
41a3a675b7d499ece87e8ade91b5a38cf045058a
-
SHA256
2d7ef95d0af8974a462e2c2ebb74c259c6a45e6972c0872bc540c57d62d1ad99
-
SHA512
f2a6ee7b087465ad664b96b18a32564074851dc2347852454bf4f7e0d63c59e8b8550d23370228e0ae7058385a44707f140b589fec13f90d084f160bedefe25a
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-