General
-
Target
fa0e9e5559910365f159a438c5b6ebc401dbdfe0e349a63c85f695d61a904500.exe
-
Size
829KB
-
Sample
240425-cmyvhsdf6y
-
MD5
a963ffef0ef9cfcee28853394947cb02
-
SHA1
abc9d7df3e07b029aea7b065e9dbfa257b3e951c
-
SHA256
fa0e9e5559910365f159a438c5b6ebc401dbdfe0e349a63c85f695d61a904500
-
SHA512
52fd7e1567f8fce1cb758c2d818c5e977b5d45fbd932e9d0407850cedc1d872351c577ed7633ae77ca4a0262a0b585c3a8e7228e04bdd826a5c7f154c40ca5c1
-
SSDEEP
12288:1iIju1u8Y8wSiHDbgP+mg5IAbnOejZJyDGR5iVAN:bu1uawlDbs+mcISXQs5iVM
Behavioral task
behavioral1
Sample
fa0e9e5559910365f159a438c5b6ebc401dbdfe0e349a63c85f695d61a904500.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fa0e9e5559910365f159a438c5b6ebc401dbdfe0e349a63c85f695d61a904500.exe
Resource
win10v2004-20240412-en
Malware Config
Targets
-
-
Target
fa0e9e5559910365f159a438c5b6ebc401dbdfe0e349a63c85f695d61a904500.exe
-
Size
829KB
-
MD5
a963ffef0ef9cfcee28853394947cb02
-
SHA1
abc9d7df3e07b029aea7b065e9dbfa257b3e951c
-
SHA256
fa0e9e5559910365f159a438c5b6ebc401dbdfe0e349a63c85f695d61a904500
-
SHA512
52fd7e1567f8fce1cb758c2d818c5e977b5d45fbd932e9d0407850cedc1d872351c577ed7633ae77ca4a0262a0b585c3a8e7228e04bdd826a5c7f154c40ca5c1
-
SSDEEP
12288:1iIju1u8Y8wSiHDbgP+mg5IAbnOejZJyDGR5iVAN:bu1uawlDbs+mcISXQs5iVM
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-