General
-
Target
279b7c9dee1055584eb517c8d8349ce310419d818f4d1e096c641ab4a546404d.exe
-
Size
1.3MB
-
Sample
250107-ce2w7s1kcq
-
MD5
6daf5385290ee38da4417b8f8e30020e
-
SHA1
5929c599272e7e146ce24e234bda68778f24f7bb
-
SHA256
279b7c9dee1055584eb517c8d8349ce310419d818f4d1e096c641ab4a546404d
-
SHA512
3a9ead6575d09b192081fb413aa29fb91cfda65796f2b0927d204f3e0adc508c918a08125b6f33d8086ca7370852b68a47e2999d16bebafb69c77e4e6147abc4
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjCp:UbA30GnzV/q+DnsXgf
Malware Config
Targets
-
-
Target
279b7c9dee1055584eb517c8d8349ce310419d818f4d1e096c641ab4a546404d.exe
-
Size
1.3MB
-
MD5
6daf5385290ee38da4417b8f8e30020e
-
SHA1
5929c599272e7e146ce24e234bda68778f24f7bb
-
SHA256
279b7c9dee1055584eb517c8d8349ce310419d818f4d1e096c641ab4a546404d
-
SHA512
3a9ead6575d09b192081fb413aa29fb91cfda65796f2b0927d204f3e0adc508c918a08125b6f33d8086ca7370852b68a47e2999d16bebafb69c77e4e6147abc4
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjCp:UbA30GnzV/q+DnsXgf
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-