General
-
Target
JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c
-
Size
1.3MB
-
Sample
241230-v37rgatmcv
-
MD5
54de6db97b6c682feee9765103b272c9
-
SHA1
a0cb252a6323f97663cd3b1eec75db2c3ab8d319
-
SHA256
d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c
-
SHA512
c71dd8e04faf10ffdce681f970529e47551e31eb29d639a275f4654e7bb4f0fe29f9a6a402ca9a2e18e957ad1fe4b467b7e13af38ae32cec52f83efdcdb1fe02
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Behavioral task
behavioral1
Sample
JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
JaffaCakes118_d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c
-
Size
1.3MB
-
MD5
54de6db97b6c682feee9765103b272c9
-
SHA1
a0cb252a6323f97663cd3b1eec75db2c3ab8d319
-
SHA256
d8b45a0c6bbd494449eacaf19a4f958ebedd37d4b5f5fef8c2da0177ea025c3c
-
SHA512
c71dd8e04faf10ffdce681f970529e47551e31eb29d639a275f4654e7bb4f0fe29f9a6a402ca9a2e18e957ad1fe4b467b7e13af38ae32cec52f83efdcdb1fe02
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-