Overview

overview

10

Static

static

10

JaffaCakes...63.exe

windows7-x64

10

JaffaCakes...63.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_3b2f29e0d6e5e4169576e854602f0b72bf2e336167a076461e333696182c9263

  • Size

    1.3MB

  • Sample

    241222-bhqgxaxjhs

  • MD5

    0582981616536926acae6e8df460d0cc

  • SHA1

    30fcd653f6381b07673c5c9b9e83c2ba2c07d464

  • SHA256

    3b2f29e0d6e5e4169576e854602f0b72bf2e336167a076461e333696182c9263

  • SHA512

    92e00121dfe31cfb9d5251ea691a24697f4d9c2ed269ff26370ee1ad4c456f02635b0b01bd84e861ba0da8b447028e546ce49a17201b6a9a1ce1e7a8dcec4748

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratdiscoveryexecutioninfostealerrat

Malware Config

Targets

    • Target

      JaffaCakes118_3b2f29e0d6e5e4169576e854602f0b72bf2e336167a076461e333696182c9263

    • Size

      1.3MB

    • MD5

      0582981616536926acae6e8df460d0cc

    • SHA1

      30fcd653f6381b07673c5c9b9e83c2ba2c07d464

    • SHA256

      3b2f29e0d6e5e4169576e854602f0b72bf2e336167a076461e333696182c9263

    • SHA512

      92e00121dfe31cfb9d5251ea691a24697f4d9c2ed269ff26370ee1ad4c456f02635b0b01bd84e861ba0da8b447028e546ce49a17201b6a9a1ce1e7a8dcec4748

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratdiscoveryexecutioninfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks