General
-
Target
JaffaCakes118_fb17bf49139bfa51ff7e8de632f59b7c8919fb1d1cfab10fa4001df9d90ecad8
-
Size
1.3MB
-
Sample
241222-b1pckaxqht
-
MD5
eab5d8ba642b56cf7d68abeb9f4a60a9
-
SHA1
f1badd421425c5d9d97c5b862ef29520d34e4ef4
-
SHA256
fb17bf49139bfa51ff7e8de632f59b7c8919fb1d1cfab10fa4001df9d90ecad8
-
SHA512
d707ef3663abcdb9264fa996c0d7478f6184802a1ff003c13967cd75f7c9bf58b6c970ba5a25c1f0584656ffaef9a092beb7b6d097df94a75aa12abdcbbd619b
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Targets
-
-
Target
JaffaCakes118_fb17bf49139bfa51ff7e8de632f59b7c8919fb1d1cfab10fa4001df9d90ecad8
-
Size
1.3MB
-
MD5
eab5d8ba642b56cf7d68abeb9f4a60a9
-
SHA1
f1badd421425c5d9d97c5b862ef29520d34e4ef4
-
SHA256
fb17bf49139bfa51ff7e8de632f59b7c8919fb1d1cfab10fa4001df9d90ecad8
-
SHA512
d707ef3663abcdb9264fa996c0d7478f6184802a1ff003c13967cd75f7c9bf58b6c970ba5a25c1f0584656ffaef9a092beb7b6d097df94a75aa12abdcbbd619b
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-