General
-
Target
86e9ac84264ae29059d78e2a3ebedea8d3b6c1083d03b82bdab8e32d306fd8a9.exe
-
Size
901KB
-
Sample
240601-a7v81sce28
-
MD5
4a8fd7bb970c86e0650a3e110fb5e6d0
-
SHA1
514e8249d87435de3b34bfd06e3dea9a6fb0fc96
-
SHA256
86e9ac84264ae29059d78e2a3ebedea8d3b6c1083d03b82bdab8e32d306fd8a9
-
SHA512
390a7e834dec74cbcc49efeee1adddb05bbe2e972e08a0ec5e6cfbecc92e4a864f6c33ce1a1d293acd42cc4f8f6ca89a8226820819170f8d86ff5e5d301e5910
-
SSDEEP
12288:ZRlDmSxJVEcVQ8KNIeyYzXIpv+KX5x3JfjaOCXzP8bGUwqHGrgc:zlDVLfVQ8KMYD/KXZfjaV8bGjqHGrF
Behavioral task
behavioral1
Sample
86e9ac84264ae29059d78e2a3ebedea8d3b6c1083d03b82bdab8e32d306fd8a9.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
86e9ac84264ae29059d78e2a3ebedea8d3b6c1083d03b82bdab8e32d306fd8a9.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
86e9ac84264ae29059d78e2a3ebedea8d3b6c1083d03b82bdab8e32d306fd8a9.exe
-
Size
901KB
-
MD5
4a8fd7bb970c86e0650a3e110fb5e6d0
-
SHA1
514e8249d87435de3b34bfd06e3dea9a6fb0fc96
-
SHA256
86e9ac84264ae29059d78e2a3ebedea8d3b6c1083d03b82bdab8e32d306fd8a9
-
SHA512
390a7e834dec74cbcc49efeee1adddb05bbe2e972e08a0ec5e6cfbecc92e4a864f6c33ce1a1d293acd42cc4f8f6ca89a8226820819170f8d86ff5e5d301e5910
-
SSDEEP
12288:ZRlDmSxJVEcVQ8KNIeyYzXIpv+KX5x3JfjaOCXzP8bGUwqHGrgc:zlDVLfVQ8KMYD/KXZfjaV8bGjqHGrF
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-