General
- Target 4f85fd9da0e6d825b520f09905b16301
- Size 1.1MB
- Sample240110-fl152aeafn
- SHA256 fd9e479531a11076bfa97269d4562bda4571f3f03f00e049e3e125d82099e942
Score
10/10
Malware Config
Targets
-
- Target 4f85fd9da0e6d825b520f09905b16301
- Size 1.1MB
- SHA256 fd9e479531a11076bfa97269d4562bda4571f3f03f00e049e3e125d82099e942
Score10/10DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Adds Run key to start application
Drops file in System32 directory