General
-
Target
b1fb36fc31e2e9e18b07abc77c833fe8.bin.exe
-
Size
1.0MB
-
Sample
230529-snfnbsch2v
-
MD5
b1fb36fc31e2e9e18b07abc77c833fe8
-
SHA1
18b1af1f4ee7a52e466fa10cbcd52f9f914c9ba9
-
SHA256
8ff008daec53167a2ec59a1fef763840c29bd032ceb6dec7c508b93d67cf809d
-
SHA512
f90a4701757645beacf1b2bea8b092cf2a4ff8e279f369eae19565a9cb37a8ac2fe13f41dfeb08626257ea0e97977044412a93165d216ab8954bf0b40de3fd4c
-
SSDEEP
24576:31VRAjJP3NZn0oWyFcNWQX/e5aG/Twy8j:3v+JPjn0tqeWQa/cy8j
Static task
static1
Behavioral task
behavioral1
Sample
b1fb36fc31e2e9e18b07abc77c833fe8.bin.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
b1fb36fc31e2e9e18b07abc77c833fe8.bin.exe
Resource
win10v2004-20230220-en
Malware Config
Targets
-
-
Target
b1fb36fc31e2e9e18b07abc77c833fe8.bin.exe
-
Size
1.0MB
-
MD5
b1fb36fc31e2e9e18b07abc77c833fe8
-
SHA1
18b1af1f4ee7a52e466fa10cbcd52f9f914c9ba9
-
SHA256
8ff008daec53167a2ec59a1fef763840c29bd032ceb6dec7c508b93d67cf809d
-
SHA512
f90a4701757645beacf1b2bea8b092cf2a4ff8e279f369eae19565a9cb37a8ac2fe13f41dfeb08626257ea0e97977044412a93165d216ab8954bf0b40de3fd4c
-
SSDEEP
24576:31VRAjJP3NZn0oWyFcNWQX/e5aG/Twy8j:3v+JPjn0tqeWQa/cy8j
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-