General
-
Target
JaffaCakes118_40a38059882f21f63d33eb2e1f06ba22d71c401affb50b3dbd8748016e7617f3
-
Size
1.3MB
-
Sample
241222-xrazgawpaj
-
MD5
11e9188c554b2c40e17041b8dc9057fb
-
SHA1
bdf0c63f320a73162fac7b82576acaf6410d1184
-
SHA256
40a38059882f21f63d33eb2e1f06ba22d71c401affb50b3dbd8748016e7617f3
-
SHA512
7ff989add684d5680e09fa974a6ffc0e578fa56bc5c2ee453835dc68891e203bca320a07f6ad10fbf358e7eb45b4576c77a6d26f893aee753e720d36b8d436ec
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Targets
-
-
Target
JaffaCakes118_40a38059882f21f63d33eb2e1f06ba22d71c401affb50b3dbd8748016e7617f3
-
Size
1.3MB
-
MD5
11e9188c554b2c40e17041b8dc9057fb
-
SHA1
bdf0c63f320a73162fac7b82576acaf6410d1184
-
SHA256
40a38059882f21f63d33eb2e1f06ba22d71c401affb50b3dbd8748016e7617f3
-
SHA512
7ff989add684d5680e09fa974a6ffc0e578fa56bc5c2ee453835dc68891e203bca320a07f6ad10fbf358e7eb45b4576c77a6d26f893aee753e720d36b8d436ec
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-