General
-
Target
fafd59661dd0865692d2793d9ae0cb4f4a62e06378757fb7eb96b5716fe07c35.exe
-
Size
829KB
-
Sample
240714-l22pdsycmg
-
MD5
fe544d94bd84fbc7713b7c033b9909a0
-
SHA1
a055c525f23ef2d479a8a6996e75536ba0545a22
-
SHA256
fafd59661dd0865692d2793d9ae0cb4f4a62e06378757fb7eb96b5716fe07c35
-
SHA512
85d17251ece1653fa3054c071f7b3e9b5a2b17ad9beb55e4c61051bd3290ab8171940773e608a31acd4689214ee3afbcce8f9182a6d6c851790482d37093cdf5
-
SSDEEP
12288:T7KTp23CjWGKMUAdqxB6StENMbAZw1WHxcpicf3Un8IGqS:G23vuUxB6StjEw1eaiSU8rN
Behavioral task
behavioral1
Sample
fafd59661dd0865692d2793d9ae0cb4f4a62e06378757fb7eb96b5716fe07c35.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
fafd59661dd0865692d2793d9ae0cb4f4a62e06378757fb7eb96b5716fe07c35.exe
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
fafd59661dd0865692d2793d9ae0cb4f4a62e06378757fb7eb96b5716fe07c35.exe
-
Size
829KB
-
MD5
fe544d94bd84fbc7713b7c033b9909a0
-
SHA1
a055c525f23ef2d479a8a6996e75536ba0545a22
-
SHA256
fafd59661dd0865692d2793d9ae0cb4f4a62e06378757fb7eb96b5716fe07c35
-
SHA512
85d17251ece1653fa3054c071f7b3e9b5a2b17ad9beb55e4c61051bd3290ab8171940773e608a31acd4689214ee3afbcce8f9182a6d6c851790482d37093cdf5
-
SSDEEP
12288:T7KTp23CjWGKMUAdqxB6StENMbAZw1WHxcpicf3Un8IGqS:G23vuUxB6StjEw1eaiSU8rN
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-