General

  • Target

    JaffaCakes118_41908e56c965ac7e326e1a38db49a1e9bcd48ae03d7a19a373d47fd88a83c55e

  • Size

    1.3MB

  • Sample

    241230-c8naxavren

  • MD5

    ae71ed436ff140b39b41007ef47fdd42

  • SHA1

    9a5dbcc95a31a31fae95e6a92588982fcf3eb90f

  • SHA256

    41908e56c965ac7e326e1a38db49a1e9bcd48ae03d7a19a373d47fd88a83c55e

  • SHA512

    6d52cfeab0cf2aa9530ed41096be3c301e624b2ce1e5f6c4dbaa09a97186e9516c41f811871153e0fcc57fae7a5c2671030c12bb3ead7d2eac4d5c58b64ac4b9

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Targets

    • Target

      JaffaCakes118_41908e56c965ac7e326e1a38db49a1e9bcd48ae03d7a19a373d47fd88a83c55e

    • Size

      1.3MB

    • MD5

      ae71ed436ff140b39b41007ef47fdd42

    • SHA1

      9a5dbcc95a31a31fae95e6a92588982fcf3eb90f

    • SHA256

      41908e56c965ac7e326e1a38db49a1e9bcd48ae03d7a19a373d47fd88a83c55e

    • SHA512

      6d52cfeab0cf2aa9530ed41096be3c301e624b2ce1e5f6c4dbaa09a97186e9516c41f811871153e0fcc57fae7a5c2671030c12bb3ead7d2eac4d5c58b64ac4b9

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Dcrat family

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks