General
-
Target
JaffaCakes118_0a5fdf9c9a479aec971378a7eab07d2e52e731ec1a8db34a913fba199deef67e
-
Size
1.3MB
-
Sample
241222-arydfavres
-
MD5
1304a2add2be8b4667d920069a5d8247
-
SHA1
b4715f3dc3c122330521e51a494e90c6969d332b
-
SHA256
0a5fdf9c9a479aec971378a7eab07d2e52e731ec1a8db34a913fba199deef67e
-
SHA512
1d2e418c4e64ac8b760ac03a3464a967c5331210a50d7d57cbf759b039ea4ad99f8eafa146390a6dc86351cadd69de9bbd340547072503f94c08b42e0ac386fc
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Behavioral task
behavioral1
Sample
JaffaCakes118_0a5fdf9c9a479aec971378a7eab07d2e52e731ec1a8db34a913fba199deef67e.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_0a5fdf9c9a479aec971378a7eab07d2e52e731ec1a8db34a913fba199deef67e.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
JaffaCakes118_0a5fdf9c9a479aec971378a7eab07d2e52e731ec1a8db34a913fba199deef67e
-
Size
1.3MB
-
MD5
1304a2add2be8b4667d920069a5d8247
-
SHA1
b4715f3dc3c122330521e51a494e90c6969d332b
-
SHA256
0a5fdf9c9a479aec971378a7eab07d2e52e731ec1a8db34a913fba199deef67e
-
SHA512
1d2e418c4e64ac8b760ac03a3464a967c5331210a50d7d57cbf759b039ea4ad99f8eafa146390a6dc86351cadd69de9bbd340547072503f94c08b42e0ac386fc
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-