General
-
Target
05b4e0a30e4bf8cd0d39f26aec6ffeaa.exe
-
Size
1.2MB
-
Sample
240601-h9hppsdh31
-
MD5
05b4e0a30e4bf8cd0d39f26aec6ffeaa
-
SHA1
d33033200167e6462497368c4fffedece8df35e6
-
SHA256
567a658aaa58107041e4810103dd6957478885bf88d6819100c861392f3c23f3
-
SHA512
18e3d7622071a316b77c2fd099b0af5559b9ecb66526e4c9d1842777e7cc6bc0671dd7b1617c9bfb442689a0fd47fc068127af10b6a8ab965047c7a02a74d174
-
SSDEEP
24576:4MQwGJ2lyovb556ebANWgJxlg4XCAlngspKIgZL:4fWlDbXiNfxMWpngZ
Malware Config
Targets
-
-
Target
05b4e0a30e4bf8cd0d39f26aec6ffeaa.exe
-
Size
1.2MB
-
MD5
05b4e0a30e4bf8cd0d39f26aec6ffeaa
-
SHA1
d33033200167e6462497368c4fffedece8df35e6
-
SHA256
567a658aaa58107041e4810103dd6957478885bf88d6819100c861392f3c23f3
-
SHA512
18e3d7622071a316b77c2fd099b0af5559b9ecb66526e4c9d1842777e7cc6bc0671dd7b1617c9bfb442689a0fd47fc068127af10b6a8ab965047c7a02a74d174
-
SSDEEP
24576:4MQwGJ2lyovb556ebANWgJxlg4XCAlngspKIgZL:4fWlDbXiNfxMWpngZ
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-