General
-
Target
4c30e9d648579aa65b9ef36bfa72baa131269c3c5c32fb841108a43d29b26f49
-
Size
1.3MB
-
Sample
241221-vcaztatmgl
-
MD5
68b34064a71f8a193b4bfd2e9ff3e603
-
SHA1
ea2d6af1ad55b8cc91582d0fb2c6ed9cfdee9541
-
SHA256
4c30e9d648579aa65b9ef36bfa72baa131269c3c5c32fb841108a43d29b26f49
-
SHA512
16e6d120bc7a5cdb84d1e7868d339bfe99c65b31a6ff2204dc67ee2d71c4e3ac28e6be476c843d8f3d9232174b1bb0fb1ba30c3abdc227a0b52d11510496f83f
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Targets
-
-
Target
4c30e9d648579aa65b9ef36bfa72baa131269c3c5c32fb841108a43d29b26f49
-
Size
1.3MB
-
MD5
68b34064a71f8a193b4bfd2e9ff3e603
-
SHA1
ea2d6af1ad55b8cc91582d0fb2c6ed9cfdee9541
-
SHA256
4c30e9d648579aa65b9ef36bfa72baa131269c3c5c32fb841108a43d29b26f49
-
SHA512
16e6d120bc7a5cdb84d1e7868d339bfe99c65b31a6ff2204dc67ee2d71c4e3ac28e6be476c843d8f3d9232174b1bb0fb1ba30c3abdc227a0b52d11510496f83f
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-