General
-
Target
2f0e4cc071bf42d0ef34db36cdc06864e2c97dd851659cb03526c85b5fa88dee
-
Size
415KB
-
Sample
240417-rr641sbh33
-
MD5
0ea791e4d3d5d3f4a76ac1a0058c5ec7
-
SHA1
b5c0e5a56e7d72c52702ee66c3d3928e0c5d1128
-
SHA256
2f0e4cc071bf42d0ef34db36cdc06864e2c97dd851659cb03526c85b5fa88dee
-
SHA512
7ef160d5fed2abad91e0bf6a7dc15b3314652b8edcb12b6cafdd896601c8480d9837f5a2336b64d8d3a56712126546910df8764e182d077f879a3cf1db2d8355
-
SSDEEP
12288:3wVgA8zlKDbj1TQNJY6WICylTLlw+EdgikmT:3wGtkfj1sNJYOVLGwi5T
Behavioral task
behavioral1
Sample
3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe
Resource
win10v2004-20240412-en
Malware Config
Targets
-
-
Target
3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe
-
Size
828KB
-
MD5
af741ec427d46644c68572c50f87d61e
-
SHA1
7e31fdcd599478fe8e6b9b07be11ff307d79ce53
-
SHA256
3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731
-
SHA512
ae5a81bcf21c60b32e67be306daa8eeb6bfa5e24723e46c8519ea095fccaf3509ba6a3f0372a0e4412d75f1c16eb0e634a3f31a77bb68c248d238c45af5896e8
-
SSDEEP
12288:dKAvgOSpwbrYBil5nRRWZlN4CBe1bqOhSiXLu5uWWDKT+pDu:hvgOSpwYE53+4F+OhzlmT+pDu
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-