General

  • Target

    JaffaCakes118_adf57eb508855b64badce5d0b561ba68e83542241fc660bd7ebe12343e66dd44

  • Size

    1.3MB

  • Sample

    241222-aezezavmdz

  • MD5

    118a83a662cd18b48b9fbb4037f4c3db

  • SHA1

    cded3860f87d1c40f0728be7520a3edbe3ccb333

  • SHA256

    adf57eb508855b64badce5d0b561ba68e83542241fc660bd7ebe12343e66dd44

  • SHA512

    663e6ccb8ba2bfa8a7e84efa7a6dedad2dcfa5e85c372dcf3fe509d807d1a563a6476dfa173bb8fdd9719165f5a3547d57dd51e26938d3e39f5abd8121798109

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Targets

    • Target

      JaffaCakes118_adf57eb508855b64badce5d0b561ba68e83542241fc660bd7ebe12343e66dd44

    • Size

      1.3MB

    • MD5

      118a83a662cd18b48b9fbb4037f4c3db

    • SHA1

      cded3860f87d1c40f0728be7520a3edbe3ccb333

    • SHA256

      adf57eb508855b64badce5d0b561ba68e83542241fc660bd7ebe12343e66dd44

    • SHA512

      663e6ccb8ba2bfa8a7e84efa7a6dedad2dcfa5e85c372dcf3fe509d807d1a563a6476dfa173bb8fdd9719165f5a3547d57dd51e26938d3e39f5abd8121798109

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Dcrat family

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks