General
-
Target
cheeto.exe
-
Size
1.8MB
-
Sample
241201-2tegws1lcl
-
MD5
42b89874d3138f40f32285be945f2ceb
-
SHA1
1766b4c4a040ba19afc4318e9b2eab775fee88d7
-
SHA256
619f85e67208f3639eacc3121636208ce043ce5cf1f5204b86857cb03b5a004a
-
SHA512
df44c7f5677a0b8e181f52b5c865315672b7c90b37f99c3b5e31714bdbb47d32d652073c42f1e614d2911faddc0394411aa3e1b8c3f832549c0d52f409722ca9
-
SSDEEP
49152:QdBn+oix+Z7vL4tzzQVGVzDd3Omjq+FLof:QdB+jx+Jv6zQVy1FLof
Static task
static1
Behavioral task
behavioral1
Sample
cheeto.exe
Resource
win10ltsc2021-20241023-en
Malware Config
Targets
-
-
Target
cheeto.exe
-
Size
1.8MB
-
MD5
42b89874d3138f40f32285be945f2ceb
-
SHA1
1766b4c4a040ba19afc4318e9b2eab775fee88d7
-
SHA256
619f85e67208f3639eacc3121636208ce043ce5cf1f5204b86857cb03b5a004a
-
SHA512
df44c7f5677a0b8e181f52b5c865315672b7c90b37f99c3b5e31714bdbb47d32d652073c42f1e614d2911faddc0394411aa3e1b8c3f832549c0d52f409722ca9
-
SSDEEP
49152:QdBn+oix+Z7vL4tzzQVGVzDd3Omjq+FLof:QdB+jx+Jv6zQVy1FLof
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-