General
-
Target
0fd55b4277f417ddcf927bc94bff8b96415b9630dfcf3e8aac3e153dc015a4a9.exe
-
Size
1.1MB
-
Sample
240618-sf193ayeld
-
MD5
0da9851aec9b55401560a80652ef22a6
-
SHA1
f4614e579ae7977d467dd23fdadd4184f729f671
-
SHA256
0fd55b4277f417ddcf927bc94bff8b96415b9630dfcf3e8aac3e153dc015a4a9
-
SHA512
f15715ecbc350aea27ac0aa58813971f9a174bad91a6f544b23f0c5b5f6195dbb3ae4e9c05c8907ed2d2b9fb79e7c99fa23852c1de0662354a59f24f90d2fa17
-
SSDEEP
24576:pQzcU/6acskHQzt5uLcMuiDdIY/8tjMTne3Kllsw:YcU/6r5HQz37liZIuHll
Static task
static1
Behavioral task
behavioral1
Sample
0fd55b4277f417ddcf927bc94bff8b96415b9630dfcf3e8aac3e153dc015a4a9.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
0fd55b4277f417ddcf927bc94bff8b96415b9630dfcf3e8aac3e153dc015a4a9.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
0fd55b4277f417ddcf927bc94bff8b96415b9630dfcf3e8aac3e153dc015a4a9.exe
-
Size
1.1MB
-
MD5
0da9851aec9b55401560a80652ef22a6
-
SHA1
f4614e579ae7977d467dd23fdadd4184f729f671
-
SHA256
0fd55b4277f417ddcf927bc94bff8b96415b9630dfcf3e8aac3e153dc015a4a9
-
SHA512
f15715ecbc350aea27ac0aa58813971f9a174bad91a6f544b23f0c5b5f6195dbb3ae4e9c05c8907ed2d2b9fb79e7c99fa23852c1de0662354a59f24f90d2fa17
-
SSDEEP
24576:pQzcU/6acskHQzt5uLcMuiDdIY/8tjMTne3Kllsw:YcU/6r5HQz37liZIuHll
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-