General

  • Target

    34301fcacf0ad5e529c86178d70caf50_NeikiAnalytics

  • Size

    828KB

  • Sample

    240512-vs1keafg8x

  • MD5

    34301fcacf0ad5e529c86178d70caf50

  • SHA1

    0bd0a9052ed9c30ff90853e41dbc17469497150f

  • SHA256

    cd18636053fef3c3b38665a36b52bdf1b4d0b6259effb5498a262b912ec725a6

  • SHA512

    d0f3f0fd16469d9255df7128a417335ac4792274fe936792915df9bd6b5ada26dc3fbd77d65c6889b088682a040ae918382fef95979b0a2e76a7774daceaa52b

  • SSDEEP

    12288:Q43QUqfC0HBtYhfthOdVXn27SQq1RyhISEzOPX/ZiXWbSor:KUqfC0fnPawzMBiXYXr

Score
10/10

Malware Config

Targets

    • Target

      34301fcacf0ad5e529c86178d70caf50_NeikiAnalytics

    • Size

      828KB

    • MD5

      34301fcacf0ad5e529c86178d70caf50

    • SHA1

      0bd0a9052ed9c30ff90853e41dbc17469497150f

    • SHA256

      cd18636053fef3c3b38665a36b52bdf1b4d0b6259effb5498a262b912ec725a6

    • SHA512

      d0f3f0fd16469d9255df7128a417335ac4792274fe936792915df9bd6b5ada26dc3fbd77d65c6889b088682a040ae918382fef95979b0a2e76a7774daceaa52b

    • SSDEEP

      12288:Q43QUqfC0HBtYhfthOdVXn27SQq1RyhISEzOPX/ZiXWbSor:KUqfC0fnPawzMBiXYXr

    Score
    10/10
    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks