General
-
Target
1d875bcd71102677c04e5db72094f6f9.exe
-
Size
1.2MB
-
Sample
240623-we5smssapk
-
MD5
1d875bcd71102677c04e5db72094f6f9
-
SHA1
0d4a9cb8d53328a6714431470674d95d044a0267
-
SHA256
1a9615dd0d975c3f8310789455af28e3fb0938c20b7d8a9d85cafc7d8cafa02c
-
SHA512
c4ba1f5fbdf619c40718a95bc5146d5b595f394bc8813582c3613b82fa5c020ec5d0c24974c121b27ade1ff5c342be68adac4d3800782865f19adb826c9bb497
-
SSDEEP
24576:ofq5IC+ahvH7BxgM6/GpfDl+siRFlU+iHkZcI:oaRjlZcPU+iH
Behavioral task
behavioral1
Sample
1d875bcd71102677c04e5db72094f6f9.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1d875bcd71102677c04e5db72094f6f9.exe
Resource
win10v2004-20240611-en
Malware Config
Targets
-
-
Target
1d875bcd71102677c04e5db72094f6f9.exe
-
Size
1.2MB
-
MD5
1d875bcd71102677c04e5db72094f6f9
-
SHA1
0d4a9cb8d53328a6714431470674d95d044a0267
-
SHA256
1a9615dd0d975c3f8310789455af28e3fb0938c20b7d8a9d85cafc7d8cafa02c
-
SHA512
c4ba1f5fbdf619c40718a95bc5146d5b595f394bc8813582c3613b82fa5c020ec5d0c24974c121b27ade1ff5c342be68adac4d3800782865f19adb826c9bb497
-
SSDEEP
24576:ofq5IC+ahvH7BxgM6/GpfDl+siRFlU+iHkZcI:oaRjlZcPU+iH
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-