General
-
Target
JaffaCakes118_f0b7fb9a020e75a8afbc5f795e521b0fa245552b0c0bcf333391b6d6fefab483
-
Size
1.3MB
-
Sample
241230-vveeys1kaj
-
MD5
299c7c03abcf15471356b945392a5089
-
SHA1
9458e5826cd7a493bf10e919b956bfcfb6454288
-
SHA256
f0b7fb9a020e75a8afbc5f795e521b0fa245552b0c0bcf333391b6d6fefab483
-
SHA512
51e7ccd1b7fbfd343f19a5c6ca79c228941bad697b5aed83e73fd3b2b515e2fcd233906141cb63980781d183bd1e7e0073c7633279a3dc55c026382c885aa0b3
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Behavioral task
behavioral1
Sample
JaffaCakes118_f0b7fb9a020e75a8afbc5f795e521b0fa245552b0c0bcf333391b6d6fefab483.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_f0b7fb9a020e75a8afbc5f795e521b0fa245552b0c0bcf333391b6d6fefab483.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
JaffaCakes118_f0b7fb9a020e75a8afbc5f795e521b0fa245552b0c0bcf333391b6d6fefab483
-
Size
1.3MB
-
MD5
299c7c03abcf15471356b945392a5089
-
SHA1
9458e5826cd7a493bf10e919b956bfcfb6454288
-
SHA256
f0b7fb9a020e75a8afbc5f795e521b0fa245552b0c0bcf333391b6d6fefab483
-
SHA512
51e7ccd1b7fbfd343f19a5c6ca79c228941bad697b5aed83e73fd3b2b515e2fcd233906141cb63980781d183bd1e7e0073c7633279a3dc55c026382c885aa0b3
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-