General
-
Target
4c6439b0226104b055a4e16c2f2c62cf68173bb3d6c04eeefb8c7055243c8bdcN
-
Size
1.3MB
-
Sample
241107-qaxctavpbr
-
MD5
3588c45216ac15b394696325eea1f7b0
-
SHA1
1b7f9c793e3a1a62e4954d18520cbdc97fbe4524
-
SHA256
4c6439b0226104b055a4e16c2f2c62cf68173bb3d6c04eeefb8c7055243c8bdc
-
SHA512
dfe2be818e7d7131eeeeff5a3f55e97af0ee02e5f1bcb19ab94dfe0d230e097fbd47c146259f6fabfc95d23a9728e07a64436ce9e1eff2ad07c671b45e760ff4
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Targets
-
-
Target
4c6439b0226104b055a4e16c2f2c62cf68173bb3d6c04eeefb8c7055243c8bdcN
-
Size
1.3MB
-
MD5
3588c45216ac15b394696325eea1f7b0
-
SHA1
1b7f9c793e3a1a62e4954d18520cbdc97fbe4524
-
SHA256
4c6439b0226104b055a4e16c2f2c62cf68173bb3d6c04eeefb8c7055243c8bdc
-
SHA512
dfe2be818e7d7131eeeeff5a3f55e97af0ee02e5f1bcb19ab94dfe0d230e097fbd47c146259f6fabfc95d23a9728e07a64436ce9e1eff2ad07c671b45e760ff4
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-