Overview

overview

10

Static

static

10

JaffaCakes...af.exe

windows7-x64

10

JaffaCakes...af.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_4471dab7851924da2560ea4e49f1aa3f26c8568e4e20d29f4a69d4c35702cbaf

  • Size

    1.3MB

  • Sample

    241222-jr6jgszqak

  • MD5

    0239dea988a6108586715c16de084b09

  • SHA1

    b24d00151ab414c24516b50ae2596b551ae15959

  • SHA256

    4471dab7851924da2560ea4e49f1aa3f26c8568e4e20d29f4a69d4c35702cbaf

  • SHA512

    ef88d9a5816795e2065460c9705d250e01c4bfadb78cf3aa565205d0413d91da775cd12a61c9d641163af9e7e7329cc8d192791d40440317853607f28cfc4669

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratdiscoveryexecutioninfostealerrat

Malware Config

Targets

    • Target

      JaffaCakes118_4471dab7851924da2560ea4e49f1aa3f26c8568e4e20d29f4a69d4c35702cbaf

    • Size

      1.3MB

    • MD5

      0239dea988a6108586715c16de084b09

    • SHA1

      b24d00151ab414c24516b50ae2596b551ae15959

    • SHA256

      4471dab7851924da2560ea4e49f1aa3f26c8568e4e20d29f4a69d4c35702cbaf

    • SHA512

      ef88d9a5816795e2065460c9705d250e01c4bfadb78cf3aa565205d0413d91da775cd12a61c9d641163af9e7e7329cc8d192791d40440317853607f28cfc4669

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratdiscoveryexecutioninfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks