General
-
Target
JaffaCakes118_5395e93ec3e4f0eadfd201ff31d81602aab865840752f0b7407ef061f331a555
-
Size
1.3MB
-
Sample
241221-3sbkaatrbs
-
MD5
7e83bd0b3bd7af7027451ea6a5d36741
-
SHA1
6641581601fe7d6475ed5bc9a14f42333957ea63
-
SHA256
5395e93ec3e4f0eadfd201ff31d81602aab865840752f0b7407ef061f331a555
-
SHA512
daf2bb3df2240a7dbda29d192932530c4b8e7f1f7e62def4bec51b74954e8ddf3cc4f1095d9b001dc75198eca3064eb40e5c6006f173f605551c29efde176f84
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Behavioral task
behavioral1
Sample
JaffaCakes118_5395e93ec3e4f0eadfd201ff31d81602aab865840752f0b7407ef061f331a555.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_5395e93ec3e4f0eadfd201ff31d81602aab865840752f0b7407ef061f331a555.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
JaffaCakes118_5395e93ec3e4f0eadfd201ff31d81602aab865840752f0b7407ef061f331a555
-
Size
1.3MB
-
MD5
7e83bd0b3bd7af7027451ea6a5d36741
-
SHA1
6641581601fe7d6475ed5bc9a14f42333957ea63
-
SHA256
5395e93ec3e4f0eadfd201ff31d81602aab865840752f0b7407ef061f331a555
-
SHA512
daf2bb3df2240a7dbda29d192932530c4b8e7f1f7e62def4bec51b74954e8ddf3cc4f1095d9b001dc75198eca3064eb40e5c6006f173f605551c29efde176f84
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-