General
-
Target
JaffaCakes118_adf79dfd7aa3ca6c8b128933eb74bb16317bb0c9143005dca57907a9a112acd6
-
Size
1.3MB
-
Sample
241230-v2xvwatlhv
-
MD5
ce93576e0a5b44f4aeb32124bd140460
-
SHA1
99c15083ece325958a02c176abb6a74935c00960
-
SHA256
adf79dfd7aa3ca6c8b128933eb74bb16317bb0c9143005dca57907a9a112acd6
-
SHA512
6046d3a6eafce983bfe67f1eb6eb20f34155a4d427847e1a8c984ab67299c01db422a4d328ab796c290fc7bde3f061d727d5133850b7640d2eb8b7b76f693fff
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Behavioral task
behavioral1
Sample
JaffaCakes118_adf79dfd7aa3ca6c8b128933eb74bb16317bb0c9143005dca57907a9a112acd6.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_adf79dfd7aa3ca6c8b128933eb74bb16317bb0c9143005dca57907a9a112acd6.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
JaffaCakes118_adf79dfd7aa3ca6c8b128933eb74bb16317bb0c9143005dca57907a9a112acd6
-
Size
1.3MB
-
MD5
ce93576e0a5b44f4aeb32124bd140460
-
SHA1
99c15083ece325958a02c176abb6a74935c00960
-
SHA256
adf79dfd7aa3ca6c8b128933eb74bb16317bb0c9143005dca57907a9a112acd6
-
SHA512
6046d3a6eafce983bfe67f1eb6eb20f34155a4d427847e1a8c984ab67299c01db422a4d328ab796c290fc7bde3f061d727d5133850b7640d2eb8b7b76f693fff
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-