General
- Target b817873fadd6af466832355a47d1e9ae.bin
- Size 589KB
- Sample240530-dgr1fsda39
- SHA256 0f6215b559b8436f2bd82dacca1a3ea76c1cee35c3f7f526388c0282ecb699db
Score
10/10
Malware Config
Targets
-
- Target c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
- Size 1000KB
- SHA256 c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581
Score10/10DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE