General
-
Target
ce5b12124122fed5473c3cc15f04accd98843494ec9f92a237a8b7c23ad63db5.exe
-
Size
1.3MB
-
Sample
250108-zr1agavrgk
-
MD5
3e575d995cda5a0dccb22033921e27cd
-
SHA1
79f06e0bedf76efced88e51d8ee9e23569d2d6fd
-
SHA256
ce5b12124122fed5473c3cc15f04accd98843494ec9f92a237a8b7c23ad63db5
-
SHA512
f40ce24e75cae1e61b1357325d85155021938219acc949540faeb76565a4f18281ff218fdf959c38d372779d27a5243409970e1054d62e63406f6c99194cf3c7
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjCr:UbA30GnzV/q+DnsXgN
Malware Config
Targets
-
-
Target
ce5b12124122fed5473c3cc15f04accd98843494ec9f92a237a8b7c23ad63db5.exe
-
Size
1.3MB
-
MD5
3e575d995cda5a0dccb22033921e27cd
-
SHA1
79f06e0bedf76efced88e51d8ee9e23569d2d6fd
-
SHA256
ce5b12124122fed5473c3cc15f04accd98843494ec9f92a237a8b7c23ad63db5
-
SHA512
f40ce24e75cae1e61b1357325d85155021938219acc949540faeb76565a4f18281ff218fdf959c38d372779d27a5243409970e1054d62e63406f6c99194cf3c7
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjCr:UbA30GnzV/q+DnsXgN
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-