Overview

overview

10

Static

static

10

JaffaCakes...a4.exe

windows7-x64

10

JaffaCakes...a4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_c0d608e4c7ed8c7e727458cbd9f265e59dd454d6e7624b5f834284d7cb8804a4

  • Size

    1.3MB

  • Sample

    241222-nyndpsxler

  • MD5

    767e47d21d79ba98aff5be0d39ef2503

  • SHA1

    0581e3b2df07deddee34e2df8cb141e1e9ee3ac9

  • SHA256

    c0d608e4c7ed8c7e727458cbd9f265e59dd454d6e7624b5f834284d7cb8804a4

  • SHA512

    580553fe002e4b5e69705dab38dc92b9d1265baea5818fd842f5b522e3d5085f7d9dfe7faaf5390f46482b89d555be9a4649061a832b699a972d5fa63714f863

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratdiscoveryexecutioninfostealerrat

Malware Config

Targets

    • Target

      JaffaCakes118_c0d608e4c7ed8c7e727458cbd9f265e59dd454d6e7624b5f834284d7cb8804a4

    • Size

      1.3MB

    • MD5

      767e47d21d79ba98aff5be0d39ef2503

    • SHA1

      0581e3b2df07deddee34e2df8cb141e1e9ee3ac9

    • SHA256

      c0d608e4c7ed8c7e727458cbd9f265e59dd454d6e7624b5f834284d7cb8804a4

    • SHA512

      580553fe002e4b5e69705dab38dc92b9d1265baea5818fd842f5b522e3d5085f7d9dfe7faaf5390f46482b89d555be9a4649061a832b699a972d5fa63714f863

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratdiscoveryexecutioninfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks