General
-
Target
RastyClient.exe
-
Size
1.6MB
-
Sample
240721-mvsnksydpd
-
MD5
e97033f786a03e53c5b1f2f8f7459823
-
SHA1
ee716af387f986b3f89eaa8f95e2e9525a7e6dc5
-
SHA256
51803275cce1aa6e37aaa3f5cc9d28244eb27f275691254b0c916224f8cbe3f3
-
SHA512
492f847961f8bea60b2aaa9d6200148fb0b7da4a504f3bd41c624e6698d8ae5f0ac925c612cc53b099173ca1730c8c1bd6945ca8ea58d1a472fc428220c5e8ca
-
SSDEEP
24576:U2G/nvxW3Ww0tXNKse+i4rH9o95ONppeDZf/7wL6yz3dkoJoDvCJp88aQ:UbA30Xg4rdC/bIoDvC88P
Behavioral task
behavioral1
Sample
RastyClient.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
RastyClient.exe
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
RastyClient.exe
-
Size
1.6MB
-
MD5
e97033f786a03e53c5b1f2f8f7459823
-
SHA1
ee716af387f986b3f89eaa8f95e2e9525a7e6dc5
-
SHA256
51803275cce1aa6e37aaa3f5cc9d28244eb27f275691254b0c916224f8cbe3f3
-
SHA512
492f847961f8bea60b2aaa9d6200148fb0b7da4a504f3bd41c624e6698d8ae5f0ac925c612cc53b099173ca1730c8c1bd6945ca8ea58d1a472fc428220c5e8ca
-
SSDEEP
24576:U2G/nvxW3Ww0tXNKse+i4rH9o95ONppeDZf/7wL6yz3dkoJoDvCJp88aQ:UbA30Xg4rdC/bIoDvC88P
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory
-