General
-
Target
JaffaCakes118_4889445f5d98098755ff2b0fad366259cfe061eb7e7968ff7b27036cf6d26d40
-
Size
1.3MB
-
Sample
241222-eajwyasmfq
-
MD5
0b3349d9a879fe2f2e40dc2a1358be06
-
SHA1
b5debbababe208ce0523d6078080a616a738b4b3
-
SHA256
4889445f5d98098755ff2b0fad366259cfe061eb7e7968ff7b27036cf6d26d40
-
SHA512
04cbf123c194179c134e681ae70bfbcce3ec358cf66f057eed3fca561fbcc2fc36fa0f339a10e837b4d43c8452d828855ef1955227944786685efcd862b2c23f
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Targets
-
-
Target
JaffaCakes118_4889445f5d98098755ff2b0fad366259cfe061eb7e7968ff7b27036cf6d26d40
-
Size
1.3MB
-
MD5
0b3349d9a879fe2f2e40dc2a1358be06
-
SHA1
b5debbababe208ce0523d6078080a616a738b4b3
-
SHA256
4889445f5d98098755ff2b0fad366259cfe061eb7e7968ff7b27036cf6d26d40
-
SHA512
04cbf123c194179c134e681ae70bfbcce3ec358cf66f057eed3fca561fbcc2fc36fa0f339a10e837b4d43c8452d828855ef1955227944786685efcd862b2c23f
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-