General
-
Target
681aa5e2177235381439ef3021a8fcc7eef561d990323b2d51cfa416d4566ee0N
-
Size
826KB
-
Sample
241004-cg3lhsycrp
-
MD5
2bde3b50e8348b0c3588bb71849aa750
-
SHA1
cfc337706db182ef87384b8b2cb5ff90e9aca101
-
SHA256
681aa5e2177235381439ef3021a8fcc7eef561d990323b2d51cfa416d4566ee0
-
SHA512
dd8025439b4f8a85e6d3ddbee003b0cd7c8830ec56933a5c9ec4fcb3174767e6393186750f5507bba655327b7c39dc715f5716d1cf4d739aefb2ca948d4ef2d7
-
SSDEEP
12288:V1OyAKpL5A9MM0Vm6PPkHG+V7PMmqbzhYjFUj8bKaH2FlQQk6:VoY4d0VPPkHG+VD3qQGAXW/QZ6
Behavioral task
behavioral1
Sample
681aa5e2177235381439ef3021a8fcc7eef561d990323b2d51cfa416d4566ee0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
681aa5e2177235381439ef3021a8fcc7eef561d990323b2d51cfa416d4566ee0N.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
681aa5e2177235381439ef3021a8fcc7eef561d990323b2d51cfa416d4566ee0N
-
Size
826KB
-
MD5
2bde3b50e8348b0c3588bb71849aa750
-
SHA1
cfc337706db182ef87384b8b2cb5ff90e9aca101
-
SHA256
681aa5e2177235381439ef3021a8fcc7eef561d990323b2d51cfa416d4566ee0
-
SHA512
dd8025439b4f8a85e6d3ddbee003b0cd7c8830ec56933a5c9ec4fcb3174767e6393186750f5507bba655327b7c39dc715f5716d1cf4d739aefb2ca948d4ef2d7
-
SSDEEP
12288:V1OyAKpL5A9MM0Vm6PPkHG+V7PMmqbzhYjFUj8bKaH2FlQQk6:VoY4d0VPPkHG+VD3qQGAXW/QZ6
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-