General
-
Target
6dbb7863ec2cef5ef8c17fe567d007fdbab3bbe330f934da1f4146e886204606.exe
-
Size
2.3MB
-
Sample
240512-kq693agg8x
-
MD5
1e44441cdb7cc1903964568a4518241d
-
SHA1
ce24ced9c67a214eaa57af0cb9ca6248ec2da1cf
-
SHA256
6dbb7863ec2cef5ef8c17fe567d007fdbab3bbe330f934da1f4146e886204606
-
SHA512
955a7ffc7951c362043d1cb048a00efc9752a23a3485721c9b5d87cde0b8514c18a28efc1b9019d211d5e766e79b809ba35ffbe3c7b821c51823be014248529c
-
SSDEEP
49152:XNo6zhi1OEqW4gINlnI9JpWZhKGLK71HAx5ZqsdLC+HK:XivOErINl9K0px731HK
Behavioral task
behavioral1
Sample
6dbb7863ec2cef5ef8c17fe567d007fdbab3bbe330f934da1f4146e886204606.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
6dbb7863ec2cef5ef8c17fe567d007fdbab3bbe330f934da1f4146e886204606.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
6dbb7863ec2cef5ef8c17fe567d007fdbab3bbe330f934da1f4146e886204606.exe
-
Size
2.3MB
-
MD5
1e44441cdb7cc1903964568a4518241d
-
SHA1
ce24ced9c67a214eaa57af0cb9ca6248ec2da1cf
-
SHA256
6dbb7863ec2cef5ef8c17fe567d007fdbab3bbe330f934da1f4146e886204606
-
SHA512
955a7ffc7951c362043d1cb048a00efc9752a23a3485721c9b5d87cde0b8514c18a28efc1b9019d211d5e766e79b809ba35ffbe3c7b821c51823be014248529c
-
SSDEEP
49152:XNo6zhi1OEqW4gINlnI9JpWZhKGLK71HAx5ZqsdLC+HK:XivOErINl9K0px731HK
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-