Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
a323062f6eccaf91eeb8b5d699f2699e87996a62e1594ef210f25e0fd0fe2589
-
Size
1.3MB
-
Sample
230203-npkw8aad7z
-
MD5
ce8456cbda71f9238e3ccedf63d4bfa7
-
SHA1
38a4b8b5ddc64af9e25848ba1630fdf7d5241578
-
SHA256
a323062f6eccaf91eeb8b5d699f2699e87996a62e1594ef210f25e0fd0fe2589
-
SHA512
f7a7b8abbcca2685b146d8b44f27e4d796c3e44ca45a9b205ae99f3d641c539d90ff972c9145f56d9229dbcd2e2370681be7734a0de21e4b8b421119284794d6
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Behavioral task
behavioral1
Sample
a323062f6eccaf91eeb8b5d699f2699e87996a62e1594ef210f25e0fd0fe2589.exe
Resource
win10v2004-20221111-en
Malware Config
Targets
-
-
Target
a323062f6eccaf91eeb8b5d699f2699e87996a62e1594ef210f25e0fd0fe2589
-
Size
1.3MB
-
MD5
ce8456cbda71f9238e3ccedf63d4bfa7
-
SHA1
38a4b8b5ddc64af9e25848ba1630fdf7d5241578
-
SHA256
a323062f6eccaf91eeb8b5d699f2699e87996a62e1594ef210f25e0fd0fe2589
-
SHA512
f7a7b8abbcca2685b146d8b44f27e4d796c3e44ca45a9b205ae99f3d641c539d90ff972c9145f56d9229dbcd2e2370681be7734a0de21e4b8b421119284794d6
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-