Overview

overview

10

Static

static

10

JaffaCakes...cb.exe

windows7-x64

10

JaffaCakes...cb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_f7d01d835cb11601638ce194bac65d0f77d6bfd91845e1220300c78e216632cb

  • Size

    1.3MB

  • Sample

    241222-fn8b5avket

  • MD5

    240968f9a8d0b5e775a1b6abb1413f4d

  • SHA1

    bf398892624a151292590646a6b32aa8a7f1ee39

  • SHA256

    f7d01d835cb11601638ce194bac65d0f77d6bfd91845e1220300c78e216632cb

  • SHA512

    fd9f38ecd92d4737720235addbb0a758da2186a8ee2d73d37a14bc54170161d5e869046b14f5a69caba9119028f75cef869ca8ab526b20834692075a896aabfa

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratdiscoveryexecutioninfostealerrat

Malware Config

Targets

    • Target

      JaffaCakes118_f7d01d835cb11601638ce194bac65d0f77d6bfd91845e1220300c78e216632cb

    • Size

      1.3MB

    • MD5

      240968f9a8d0b5e775a1b6abb1413f4d

    • SHA1

      bf398892624a151292590646a6b32aa8a7f1ee39

    • SHA256

      f7d01d835cb11601638ce194bac65d0f77d6bfd91845e1220300c78e216632cb

    • SHA512

      fd9f38ecd92d4737720235addbb0a758da2186a8ee2d73d37a14bc54170161d5e869046b14f5a69caba9119028f75cef869ca8ab526b20834692075a896aabfa

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratdiscoveryexecutioninfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks