General
-
Target
FF3F337BA133257BF7EF80C83AF6A374.exe
-
Size
1.7MB
-
Sample
241208-tpde2aylfx
-
MD5
ff3f337ba133257bf7ef80c83af6a374
-
SHA1
6c1746e5455bba5c362db11bf5aef0adaaea6337
-
SHA256
de22374f782e1898ae2c015f41159b7485122a65ef26b0850e3c0609d41f2cde
-
SHA512
f245180c0edbcd0836abc01e6660a95d698056109151e1451b8ce17c128aea1456c5cb3b23439645ef9dcc155a11801ee0d3ac6e334b66db191da98bb404a053
-
SSDEEP
24576:LKoAZDIza+c3NunPWpnVuO2PJftX9fRQY16zIWJC5JUqR8lLr0I4gyid81sRO/F:LKdluO2P3N5QkWtlLr0ICNyO
Static task
static1
Behavioral task
behavioral1
Sample
FF3F337BA133257BF7EF80C83AF6A374.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
FF3F337BA133257BF7EF80C83AF6A374.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
FF3F337BA133257BF7EF80C83AF6A374.exe
-
Size
1.7MB
-
MD5
ff3f337ba133257bf7ef80c83af6a374
-
SHA1
6c1746e5455bba5c362db11bf5aef0adaaea6337
-
SHA256
de22374f782e1898ae2c015f41159b7485122a65ef26b0850e3c0609d41f2cde
-
SHA512
f245180c0edbcd0836abc01e6660a95d698056109151e1451b8ce17c128aea1456c5cb3b23439645ef9dcc155a11801ee0d3ac6e334b66db191da98bb404a053
-
SSDEEP
24576:LKoAZDIza+c3NunPWpnVuO2PJftX9fRQY16zIWJC5JUqR8lLr0I4gyid81sRO/F:LKdluO2P3N5QkWtlLr0ICNyO
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-