General
-
Target
JaffaCakes118_74923c5d4bbc06b927e307c7685ba04375ccde9a565da6be0f0bd2b8dc167247
-
Size
1.3MB
-
Sample
241221-zflmyayqbv
-
MD5
529a45efc155aaa872854d4c33effc8c
-
SHA1
48cee4c8a3cd4009aeb3c3e072e08427c1b88715
-
SHA256
74923c5d4bbc06b927e307c7685ba04375ccde9a565da6be0f0bd2b8dc167247
-
SHA512
e04c122507b00a93e9f30884c927ac5f71f2a50cc136c4bcd505a36e80ff86f1be6fd3a9e0a3d3c757f01cf815d6e81c2007463c78ab8a5b358cf5d44558843f
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Targets
-
-
Target
JaffaCakes118_74923c5d4bbc06b927e307c7685ba04375ccde9a565da6be0f0bd2b8dc167247
-
Size
1.3MB
-
MD5
529a45efc155aaa872854d4c33effc8c
-
SHA1
48cee4c8a3cd4009aeb3c3e072e08427c1b88715
-
SHA256
74923c5d4bbc06b927e307c7685ba04375ccde9a565da6be0f0bd2b8dc167247
-
SHA512
e04c122507b00a93e9f30884c927ac5f71f2a50cc136c4bcd505a36e80ff86f1be6fd3a9e0a3d3c757f01cf815d6e81c2007463c78ab8a5b358cf5d44558843f
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-