Overview

overview

10

Static

static

10

JaffaCakes...92.exe

windows7-x64

10

JaffaCakes...92.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_080f4cef3580490cb80d2994f7c760aac5a89119efb0ad74b452faf47d81ef92

  • Size

    1.3MB

  • Sample

    241222-l2yyhatmfv

  • MD5

    3238125d5b0e217b96771a01ea0b549e

  • SHA1

    0d9c0ddce60ad1feb5faeda5b189a1763053f930

  • SHA256

    080f4cef3580490cb80d2994f7c760aac5a89119efb0ad74b452faf47d81ef92

  • SHA512

    88f2c39ad0eec7397e879731b6709de200d7d88a161de62c1ebf98f65f970e078454ebf23381919adc1d5e472d80c9c756b8f5159274ebefd549d2e7c063bbe5

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratdiscoveryexecutioninfostealerrat

Malware Config

Targets

    • Target

      JaffaCakes118_080f4cef3580490cb80d2994f7c760aac5a89119efb0ad74b452faf47d81ef92

    • Size

      1.3MB

    • MD5

      3238125d5b0e217b96771a01ea0b549e

    • SHA1

      0d9c0ddce60ad1feb5faeda5b189a1763053f930

    • SHA256

      080f4cef3580490cb80d2994f7c760aac5a89119efb0ad74b452faf47d81ef92

    • SHA512

      88f2c39ad0eec7397e879731b6709de200d7d88a161de62c1ebf98f65f970e078454ebf23381919adc1d5e472d80c9c756b8f5159274ebefd549d2e7c063bbe5

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratdiscoveryexecutioninfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks