General
-
Target
1a9c19cd373f9ce0642f18f6965521b3.bin
-
Size
731KB
-
Sample
240729-cnf14asclc
-
MD5
5a04b898f0ed81d67ec6b45a87364fb1
-
SHA1
b8e7c150c0a7f896b022d7cabac49aa9c8e95e32
-
SHA256
8fdf276499e757074ab09e455ed6827cf8d981212a5fb9aafdf586c264ee3fac
-
SHA512
0d69a5aa67c12e0025942a7c5557fe4bd1a2c1c4caf84eee9294e73b728b74292934a379a6fe580a9a01f0074bdf91c422ec4d004a0343fdd7d4bc9a70e14a65
-
SSDEEP
12288:RUzC+/pu20V7f5i3CAx49mHZkvxcbSd4ml4IqyxTIvsDeW877TpoN:4CEudBakvxcWudIqyxTMEeJpw
Behavioral task
behavioral1
Sample
82bea7c0254a8a0b675f8702eb3dafbbcc608bdb672738d159b33ae699a4d5bb.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
82bea7c0254a8a0b675f8702eb3dafbbcc608bdb672738d159b33ae699a4d5bb.exe
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
82bea7c0254a8a0b675f8702eb3dafbbcc608bdb672738d159b33ae699a4d5bb.exe
-
Size
1.1MB
-
MD5
1a9c19cd373f9ce0642f18f6965521b3
-
SHA1
64bc66f217964ab7310084cc9b2e4ef72ea7156b
-
SHA256
82bea7c0254a8a0b675f8702eb3dafbbcc608bdb672738d159b33ae699a4d5bb
-
SHA512
3b68254d3425e45f2d28dbdf0507fe723ea4ef493c33707fb94ea23d30e59ad63c8ba30d7efc3102d88bda70d60ab3895f2e8dcdd9383260ef3807afd6cf2349
-
SSDEEP
24576:10ybzboC40b/IwQSETTrn/BBhA/nJTbEHzsS/:10ykC40nEIdSzs
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-