General
-
Target
JaffaCakes118_375ce4a9beabd459e3f5459cec75a1b1e8e2814443bae7914553d7b266ed1923
-
Size
1.3MB
-
Sample
241230-b9w4rstqbm
-
MD5
b0e7be27280e7a6e75df7c8590b35067
-
SHA1
e1331032a6911e4257c59a22850181bcaeb17a58
-
SHA256
375ce4a9beabd459e3f5459cec75a1b1e8e2814443bae7914553d7b266ed1923
-
SHA512
1bdc408beb993c93f582d26a240f18f01c73632c922bca902d59eef40f84836e4ed06cbc44faf69d7dd6ec5b849fff7903c7327f4a3a264b4020e40c47c3327d
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Behavioral task
behavioral1
Sample
JaffaCakes118_375ce4a9beabd459e3f5459cec75a1b1e8e2814443bae7914553d7b266ed1923.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
JaffaCakes118_375ce4a9beabd459e3f5459cec75a1b1e8e2814443bae7914553d7b266ed1923.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
JaffaCakes118_375ce4a9beabd459e3f5459cec75a1b1e8e2814443bae7914553d7b266ed1923
-
Size
1.3MB
-
MD5
b0e7be27280e7a6e75df7c8590b35067
-
SHA1
e1331032a6911e4257c59a22850181bcaeb17a58
-
SHA256
375ce4a9beabd459e3f5459cec75a1b1e8e2814443bae7914553d7b266ed1923
-
SHA512
1bdc408beb993c93f582d26a240f18f01c73632c922bca902d59eef40f84836e4ed06cbc44faf69d7dd6ec5b849fff7903c7327f4a3a264b4020e40c47c3327d
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-