Overview

overview

10

Static

static

10

JaffaCakes...5a.exe

windows7-x64

10

JaffaCakes...5a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_c07cdd8d27b5b968b06166ceddcfd35a

  • Size

    2.0MB

  • Sample

    250109-gltxds1kfx

  • MD5

    c07cdd8d27b5b968b06166ceddcfd35a

  • SHA1

    419905135ad7276f36edd5654ff50643875d52b3

  • SHA256

    6b350fefc7d6ca79ca3e4cef39b4e71e7459d98ef213693ae3cec2c1b1d03863

  • SHA512

    01ddba53ed10452aeefde7aa2bcb289d75d5ce90fe0771183d5abc5f3a178d20b5495381084e75e858130bf31dbdd33edf82d51c96d1e4a99ee4c21bf97327ed

  • SSDEEP

    49152:kqL5o66QwgVAVph9QBoyycpwgPGdnDq3IEP:x7oh9yycFODq3vP

Score
10/10
dcratinfostealerpersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_c07cdd8d27b5b968b06166ceddcfd35a

    • Size

      2.0MB

    • MD5

      c07cdd8d27b5b968b06166ceddcfd35a

    • SHA1

      419905135ad7276f36edd5654ff50643875d52b3

    • SHA256

      6b350fefc7d6ca79ca3e4cef39b4e71e7459d98ef213693ae3cec2c1b1d03863

    • SHA512

      01ddba53ed10452aeefde7aa2bcb289d75d5ce90fe0771183d5abc5f3a178d20b5495381084e75e858130bf31dbdd33edf82d51c96d1e4a99ee4c21bf97327ed

    • SSDEEP

      49152:kqL5o66QwgVAVph9QBoyycpwgPGdnDq3IEP:x7oh9yycFODq3vP

    Score
    10/10
    dcratinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks