General
-
Target
0eae001edceff3bc23cadaae071dfc32.exe
-
Size
206KB
-
Sample
230217-2cg7fshc7s
-
MD5
0eae001edceff3bc23cadaae071dfc32
-
SHA1
5d387a67ba534fd143eaea2730ad0a15e020e7e4
-
SHA256
41b4cc711899e88e5a7ddc2977d9f817f230e4186841a0d26bd66f26281562b6
-
SHA512
d6ffbacae4a9c0e0d448bad7686e7418e4e19cc77eaff39c55a02b3f7d3ce264f290dd55231281439e98e935b7f08a20ad10686a52a210c094c791f92811ee7f
-
SSDEEP
6144:i7ziNNyACm+SVpiHIu8v/1Z94630C8Ot1:+zD1m+SPiH58vdZ9J3Pt
Static task
static1
Behavioral task
behavioral1
Sample
0eae001edceff3bc23cadaae071dfc32.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0eae001edceff3bc23cadaae071dfc32.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
0eae001edceff3bc23cadaae071dfc32.exe
-
Size
206KB
-
MD5
0eae001edceff3bc23cadaae071dfc32
-
SHA1
5d387a67ba534fd143eaea2730ad0a15e020e7e4
-
SHA256
41b4cc711899e88e5a7ddc2977d9f817f230e4186841a0d26bd66f26281562b6
-
SHA512
d6ffbacae4a9c0e0d448bad7686e7418e4e19cc77eaff39c55a02b3f7d3ce264f290dd55231281439e98e935b7f08a20ad10686a52a210c094c791f92811ee7f
-
SSDEEP
6144:i7ziNNyACm+SVpiHIu8v/1Z94630C8Ot1:+zD1m+SPiH58vdZ9J3Pt
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Detects Smokeloader packer
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Uses the VBS compiler for execution
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-