General
-
Target
1177d948403b0efc96899542aa7121d3.exe
-
Size
3.8MB
-
Sample
231118-ggz8lsch6y
-
MD5
1177d948403b0efc96899542aa7121d3
-
SHA1
3cd7bf300f6482728cd5f46ea07d0a0685decfc1
-
SHA256
db356737d8940879b057bd0173aae780602b9ceb0a5790bd90e12c5cfc194088
-
SHA512
da3239d8c283d8786d81f01badfa4f2eb787a23add947cd2ecff78b65019b2ca168198263e978e664bbacd3520489a98b7c7b0d5775b2e1571396924bcc07a11
-
SSDEEP
98304:PuXEdPN+TIvz8Uv3gifh55G1bNc50ymOMFQ:Pc0P2ZsgKH5G1RUNMm
Behavioral task
behavioral1
Sample
1177d948403b0efc96899542aa7121d3.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
1177d948403b0efc96899542aa7121d3.exe
Resource
win10v2004-20231020-en
Malware Config
Targets
-
-
Target
1177d948403b0efc96899542aa7121d3.exe
-
Size
3.8MB
-
MD5
1177d948403b0efc96899542aa7121d3
-
SHA1
3cd7bf300f6482728cd5f46ea07d0a0685decfc1
-
SHA256
db356737d8940879b057bd0173aae780602b9ceb0a5790bd90e12c5cfc194088
-
SHA512
da3239d8c283d8786d81f01badfa4f2eb787a23add947cd2ecff78b65019b2ca168198263e978e664bbacd3520489a98b7c7b0d5775b2e1571396924bcc07a11
-
SSDEEP
98304:PuXEdPN+TIvz8Uv3gifh55G1bNc50ymOMFQ:Pc0P2ZsgKH5G1RUNMm
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Disables Task Manager via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-