Overview

overview

10

Static

static

3

JaffaCakes...fb.exe

windows7-x64

10

JaffaCakes...fb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_9c06e0e1858701cc632ff0ed06d48efb

  • Size

    1.5MB

  • Sample

    250108-m4ehbaxkdt

  • MD5

    9c06e0e1858701cc632ff0ed06d48efb

  • SHA1

    5683f8ac98732a31fb0da617c5b892b78ca90066

  • SHA256

    55a6107a5ad6b8cd13b69794498a3b890ed6a5803cda738bd98c16f0077f0ebf

  • SHA512

    89ef8bd6a1d6572d891502d375850d09f0e5a5682debb3def1ea06734ed3ddcd9cdf74ee08332cf85e9fe7c4b1938b307df24b4fc6670f74f002e4b2af796415

  • SSDEEP

    24576:fiINCguyl+wsmtRR2nBUIcMu6dhHp6OZ3i8G/lNBaX8Ug4iU+Z2fxOT6D2G/N1Fb:yguyYwwBxcrg8yS8G/LjU+CxLc7I

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      JaffaCakes118_9c06e0e1858701cc632ff0ed06d48efb

    • Size

      1.5MB

    • MD5

      9c06e0e1858701cc632ff0ed06d48efb

    • SHA1

      5683f8ac98732a31fb0da617c5b892b78ca90066

    • SHA256

      55a6107a5ad6b8cd13b69794498a3b890ed6a5803cda738bd98c16f0077f0ebf

    • SHA512

      89ef8bd6a1d6572d891502d375850d09f0e5a5682debb3def1ea06734ed3ddcd9cdf74ee08332cf85e9fe7c4b1938b307df24b4fc6670f74f002e4b2af796415

    • SSDEEP

      24576:fiINCguyl+wsmtRR2nBUIcMu6dhHp6OZ3i8G/lNBaX8Ug4iU+Z2fxOT6D2G/N1Fb:yguyYwwBxcrg8yS8G/LjU+CxLc7I

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks