General
- Target b817873fadd6af466832355a47d1e9ae.bin
- Size 589KB
- Sample240530-dgr1fsda39
- SHA256 0f6215b559b8436f2bd82dacca1a3ea76c1cee35c3f7f526388c0282ecb699db
Score
10/10
Malware Config
Targets
-
- Target c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
- Size 1000KB
- SHA256 c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE