General
-
Target
JaffaCakes118_06c6bbe4eca3877d32614811eb4dd7cfe150b6ed57f7e49cda3daba8e8410cad
-
Size
1.3MB
-
Sample
241222-wsvvlavqen
-
MD5
7e2c7b39d2641b61901ff55250a713a4
-
SHA1
dcbc75d4e25e235754301570402790487cb79a57
-
SHA256
06c6bbe4eca3877d32614811eb4dd7cfe150b6ed57f7e49cda3daba8e8410cad
-
SHA512
6a91c7123713b2b3e942f76fe38b6f644f158d20a44ad139e5b2685a799fd1d21a89a67c591018d9699eef55c3b39bf8cfe9009a84af5990cabf043703f97435
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Targets
-
-
Target
JaffaCakes118_06c6bbe4eca3877d32614811eb4dd7cfe150b6ed57f7e49cda3daba8e8410cad
-
Size
1.3MB
-
MD5
7e2c7b39d2641b61901ff55250a713a4
-
SHA1
dcbc75d4e25e235754301570402790487cb79a57
-
SHA256
06c6bbe4eca3877d32614811eb4dd7cfe150b6ed57f7e49cda3daba8e8410cad
-
SHA512
6a91c7123713b2b3e942f76fe38b6f644f158d20a44ad139e5b2685a799fd1d21a89a67c591018d9699eef55c3b39bf8cfe9009a84af5990cabf043703f97435
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-