General
-
Target
1610d005e2af505e573a49eecd7dadb7.exe
-
Size
1.3MB
-
Sample
240523-flel2aee2t
-
MD5
1610d005e2af505e573a49eecd7dadb7
-
SHA1
a1ddc7111c710191d364cfba6943d8be87d4f454
-
SHA256
0f0009550ad8a696b79efaddb21f8ce26236c5c302c5159e0af3d7fe75b57fd3
-
SHA512
5bd3f7ca3359e0fbe8e6b6d2ff9f007cdc2c19325c2bc24194814fe2d72fef32104d1739a6f37f4ca94a3779ee1715ec25f50e8c4dc8bac8e8397813b73feda8
-
SSDEEP
24576:xALTck+Rs8xdbtVhrETeQ35YaUccQEt5bSCi03FAx:xAnc1xQTeQ1ULi0
Behavioral task
behavioral1
Sample
1610d005e2af505e573a49eecd7dadb7.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1610d005e2af505e573a49eecd7dadb7.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
1610d005e2af505e573a49eecd7dadb7.exe
-
Size
1.3MB
-
MD5
1610d005e2af505e573a49eecd7dadb7
-
SHA1
a1ddc7111c710191d364cfba6943d8be87d4f454
-
SHA256
0f0009550ad8a696b79efaddb21f8ce26236c5c302c5159e0af3d7fe75b57fd3
-
SHA512
5bd3f7ca3359e0fbe8e6b6d2ff9f007cdc2c19325c2bc24194814fe2d72fef32104d1739a6f37f4ca94a3779ee1715ec25f50e8c4dc8bac8e8397813b73feda8
-
SSDEEP
24576:xALTck+Rs8xdbtVhrETeQ35YaUccQEt5bSCi03FAx:xAnc1xQTeQ1ULi0
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops file in System32 directory
-