Overview

overview

10

Static

static

10

9aec290016...18.exe

windows7-x64

10

9aec290016...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9aec290016ad674b1809b9359b200689_JaffaCakes118

  • Size

    654KB

  • Sample

    241125-mh85ssyldn

  • MD5

    9aec290016ad674b1809b9359b200689

  • SHA1

    6865e7cb350b1456c85db787797487901b8b22f8

  • SHA256

    6ac3d59d497f8e48d23d023b308bb2bc2d524e37c0175849cfead05c96e097af

  • SHA512

    2e4ae500367adbd3bff927bdd3a843cf7bab2c2c8d2a41d215109dde42b8e2d9c250bedef42cd8733fb599111682351615b72b9baf686725dda338ea426b5aca

  • SSDEEP

    12288:NqnO1RR3IiZDFN7/lFTSvejX9n/RXQaXYNPtBWa:N+O1DZFB/laeBpc

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      9aec290016ad674b1809b9359b200689_JaffaCakes118

    • Size

      654KB

    • MD5

      9aec290016ad674b1809b9359b200689

    • SHA1

      6865e7cb350b1456c85db787797487901b8b22f8

    • SHA256

      6ac3d59d497f8e48d23d023b308bb2bc2d524e37c0175849cfead05c96e097af

    • SHA512

      2e4ae500367adbd3bff927bdd3a843cf7bab2c2c8d2a41d215109dde42b8e2d9c250bedef42cd8733fb599111682351615b72b9baf686725dda338ea426b5aca

    • SSDEEP

      12288:NqnO1RR3IiZDFN7/lFTSvejX9n/RXQaXYNPtBWa:N+O1DZFB/laeBpc

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks