General
-
Target
JaffaCakes118_e19af9bd7aec0199c603566326446302ff66feff50b3dac708c6a416771eadbb
-
Size
1.3MB
-
Sample
241222-gnmk4awpaw
-
MD5
e55a30062a818e14ff5daa9ec5cada37
-
SHA1
b4dc2c9ba9ab3377ab0513bb5b643ed220591790
-
SHA256
e19af9bd7aec0199c603566326446302ff66feff50b3dac708c6a416771eadbb
-
SHA512
48654ee090440a7f8199f210c84143bb4b5d37414cc5c566177e0b38f74ec32f61591740db04fe7928340e657ffeb3e466daa3d82d7cec03d591dc316313773e
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Targets
-
-
Target
JaffaCakes118_e19af9bd7aec0199c603566326446302ff66feff50b3dac708c6a416771eadbb
-
Size
1.3MB
-
MD5
e55a30062a818e14ff5daa9ec5cada37
-
SHA1
b4dc2c9ba9ab3377ab0513bb5b643ed220591790
-
SHA256
e19af9bd7aec0199c603566326446302ff66feff50b3dac708c6a416771eadbb
-
SHA512
48654ee090440a7f8199f210c84143bb4b5d37414cc5c566177e0b38f74ec32f61591740db04fe7928340e657ffeb3e466daa3d82d7cec03d591dc316313773e
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-