Overview

overview

10

Static

static

3

Medal.exe

windows7-x64

10

Medal.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Medal.exe

  • Size

    1.8MB

  • Sample

    241201-qpjp9sslfz

  • MD5

    4f66bbfed3a524398bd0267ed974ccbc

  • SHA1

    b2567397dc823412d87a23428c7833ff74586b7d

  • SHA256

    fa05b7f28eb1df0447998b89a08aa96453b0f3240c31489900d178862eaa80d8

  • SHA512

    bc4de61adb5f56c66043a2617ebfcc9f4e82d36e48dbdc9178695f9466d554eb364d69829490ff43100e8cb457ce7e78b2e277a3cf1733edf32c0154e6f56d9f

  • SSDEEP

    49152:q3c6UY0hj8eu32ILwfhNE5I6OrLCXLdsN:q3cvY0Z8pGWwfhyxOrUsN

Score
10/10
dcratdiscoveryinfostealerratspywarestealer

Malware Config

Targets

    • Target

      Medal.exe

    • Size

      1.8MB

    • MD5

      4f66bbfed3a524398bd0267ed974ccbc

    • SHA1

      b2567397dc823412d87a23428c7833ff74586b7d

    • SHA256

      fa05b7f28eb1df0447998b89a08aa96453b0f3240c31489900d178862eaa80d8

    • SHA512

      bc4de61adb5f56c66043a2617ebfcc9f4e82d36e48dbdc9178695f9466d554eb364d69829490ff43100e8cb457ce7e78b2e277a3cf1733edf32c0154e6f56d9f

    • SSDEEP

      49152:q3c6UY0hj8eu32ILwfhNE5I6OrLCXLdsN:q3cvY0Z8pGWwfhyxOrUsN

    Score
    10/10
    dcratdiscoveryinfostealerratspywarestealer

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks