General
-
Target
4b501fa87e3f05f21f0e85ed63f0deb4.exe
-
Size
1.2MB
-
Sample
240516-c39xqagf7v
-
MD5
4b501fa87e3f05f21f0e85ed63f0deb4
-
SHA1
ab1f15913d82d926441805a9cd847353836a7816
-
SHA256
a083297276d53c1ea773b6a44715daa36259a8a9efcbc9c18818903c25663847
-
SHA512
3e364b17ed3bc9c4b9a696ae30ef2ee001a1012c8e51c35da41234c1127b6998e81b668078aaf99ea12cbdd4ab5e29ec2ea63f1efec4b4c41c19cdd46c515de8
-
SSDEEP
24576:U2G/nvxW3Ww0t7lDVLfVQ8KMYD/KXZfjaV8bGjqHGrFo:UbA307HV7CEZ7HW7K
Behavioral task
behavioral1
Sample
4b501fa87e3f05f21f0e85ed63f0deb4.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4b501fa87e3f05f21f0e85ed63f0deb4.exe
Resource
win10v2004-20240426-en
Malware Config
Targets
-
-
Target
4b501fa87e3f05f21f0e85ed63f0deb4.exe
-
Size
1.2MB
-
MD5
4b501fa87e3f05f21f0e85ed63f0deb4
-
SHA1
ab1f15913d82d926441805a9cd847353836a7816
-
SHA256
a083297276d53c1ea773b6a44715daa36259a8a9efcbc9c18818903c25663847
-
SHA512
3e364b17ed3bc9c4b9a696ae30ef2ee001a1012c8e51c35da41234c1127b6998e81b668078aaf99ea12cbdd4ab5e29ec2ea63f1efec4b4c41c19cdd46c515de8
-
SSDEEP
24576:U2G/nvxW3Ww0t7lDVLfVQ8KMYD/KXZfjaV8bGjqHGrFo:UbA307HV7CEZ7HW7K
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-