General

  • Target

    557d4c09c4da24b8d5c59a91c3033093_JaffaCakes118

  • Size

    1.5MB

  • Sample

    240718-a4n1jaxbrr

  • MD5

    557d4c09c4da24b8d5c59a91c3033093

  • SHA1

    d0a604bbfe5638138cc76644c8762563762eedb0

  • SHA256

    b33051a22664cdea693fbc3d6f6fa017505e6a40a65f5ebe484281d6bf661de3

  • SHA512

    0aeff6d7376dafd0bcb04e62921ad4333cbaa792b81ec8a748bf9c198c43fccfc7534e6309335f1e66b50bcbb43729e6f53dc711163113e4ffc9e628b045206e

  • SSDEEP

    49152:ZbA35RuRuN1Fdt3zWhjGmmTzWljOhGz9p:Zb6FHaimwyjxz9p

Malware Config

Targets

    • Target

      557d4c09c4da24b8d5c59a91c3033093_JaffaCakes118

    • Size

      1.5MB

    • MD5

      557d4c09c4da24b8d5c59a91c3033093

    • SHA1

      d0a604bbfe5638138cc76644c8762563762eedb0

    • SHA256

      b33051a22664cdea693fbc3d6f6fa017505e6a40a65f5ebe484281d6bf661de3

    • SHA512

      0aeff6d7376dafd0bcb04e62921ad4333cbaa792b81ec8a748bf9c198c43fccfc7534e6309335f1e66b50bcbb43729e6f53dc711163113e4ffc9e628b045206e

    • SSDEEP

      49152:ZbA35RuRuN1Fdt3zWhjGmmTzWljOhGz9p:Zb6FHaimwyjxz9p

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks