General
-
Target
38f21c0635c506322423d979758212841830cbe38e75856146f35e29c6b9b513.exe
-
Size
1.3MB
-
Sample
250108-3qhwks1mck
-
MD5
1e0852a6c7561f0993d533bdac01102e
-
SHA1
858ba633ab39fe6bb7b2fc27e2f51d96cca73575
-
SHA256
38f21c0635c506322423d979758212841830cbe38e75856146f35e29c6b9b513
-
SHA512
681075aac8777e4b2ff658c0ae7a62b45dfa4716010cb36ec903e33c444579d4af8aec6ba98f8e2e1de7d9290dfd87642fae6e57c6e4aa4b1b8adc4ea42f5eb2
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjCx:UbA30GnzV/q+DnsXgX
Malware Config
Targets
-
-
Target
38f21c0635c506322423d979758212841830cbe38e75856146f35e29c6b9b513.exe
-
Size
1.3MB
-
MD5
1e0852a6c7561f0993d533bdac01102e
-
SHA1
858ba633ab39fe6bb7b2fc27e2f51d96cca73575
-
SHA256
38f21c0635c506322423d979758212841830cbe38e75856146f35e29c6b9b513
-
SHA512
681075aac8777e4b2ff658c0ae7a62b45dfa4716010cb36ec903e33c444579d4af8aec6ba98f8e2e1de7d9290dfd87642fae6e57c6e4aa4b1b8adc4ea42f5eb2
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjCx:UbA30GnzV/q+DnsXgX
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-