General
-
Target
4931e5d3811a460f47678631f4bdc82c9c6e9176ae3940403e690bc82e3714a9.exe
-
Size
1.1MB
-
Sample
240618-vdgtrasapa
-
MD5
1ffdb66e829387a9d10032af888e9639
-
SHA1
06a5b4e196a197e5fce24fd07d374b5f0841ce2a
-
SHA256
4931e5d3811a460f47678631f4bdc82c9c6e9176ae3940403e690bc82e3714a9
-
SHA512
69771111c27284a1686c0281636851edb642bbd210426d1f71343993ecd0324579eba753b31016d477695176ad0660f6715251dfe289c689b3fc3f242367318e
-
SSDEEP
24576:U2G/nvxW3Ww0tPMKZCL1+oxyqkAWCKrSOv1D5QRyG:UbA30PJCL1qqEda
Behavioral task
behavioral1
Sample
4931e5d3811a460f47678631f4bdc82c9c6e9176ae3940403e690bc82e3714a9.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
4931e5d3811a460f47678631f4bdc82c9c6e9176ae3940403e690bc82e3714a9.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
4931e5d3811a460f47678631f4bdc82c9c6e9176ae3940403e690bc82e3714a9.exe
-
Size
1.1MB
-
MD5
1ffdb66e829387a9d10032af888e9639
-
SHA1
06a5b4e196a197e5fce24fd07d374b5f0841ce2a
-
SHA256
4931e5d3811a460f47678631f4bdc82c9c6e9176ae3940403e690bc82e3714a9
-
SHA512
69771111c27284a1686c0281636851edb642bbd210426d1f71343993ecd0324579eba753b31016d477695176ad0660f6715251dfe289c689b3fc3f242367318e
-
SSDEEP
24576:U2G/nvxW3Ww0tPMKZCL1+oxyqkAWCKrSOv1D5QRyG:UbA30PJCL1qqEda
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-