Overview

overview

10

Static

static

10

adf5cb2ba4...18.exe

windows7-x64

10

adf5cb2ba4...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    adf5cb2ba4e13eba254adea54ee6855d_JaffaCakes118

  • Size

    768KB

  • Sample

    241128-3w8des1lcn

  • MD5

    adf5cb2ba4e13eba254adea54ee6855d

  • SHA1

    00759c66c70ead273372cc31964f493105539704

  • SHA256

    9d1cda19a05364d02903a407a68a85313dff6bf47a4f3b42e62d125a8bfae4b8

  • SHA512

    c74b19c3be4bda23deb28ce880bf63751a2baa9cc8f15096187dab4c7a2bb2c01960b3e8baba364f076501fc6b9952932ccb4773d22c0ec4cd03fca54fd08ff7

  • SSDEEP

    12288:QqnO6RZ6I3yp4AcLuLPoRTsJhHZt+Uj8f+ZVFpuolCcVArWU:Q+O6zi4hL0oRAzgEFpl

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      adf5cb2ba4e13eba254adea54ee6855d_JaffaCakes118

    • Size

      768KB

    • MD5

      adf5cb2ba4e13eba254adea54ee6855d

    • SHA1

      00759c66c70ead273372cc31964f493105539704

    • SHA256

      9d1cda19a05364d02903a407a68a85313dff6bf47a4f3b42e62d125a8bfae4b8

    • SHA512

      c74b19c3be4bda23deb28ce880bf63751a2baa9cc8f15096187dab4c7a2bb2c01960b3e8baba364f076501fc6b9952932ccb4773d22c0ec4cd03fca54fd08ff7

    • SSDEEP

      12288:QqnO6RZ6I3yp4AcLuLPoRTsJhHZt+Uj8f+ZVFpuolCcVArWU:Q+O6zi4hL0oRAzgEFpl

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks