Overview

overview

10

Static

static

10

JaffaCakes...91.exe

windows7-x64

10

JaffaCakes...91.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_dfc81712a62d2f2852ea631060a9ee91

  • Size

    1.5MB

  • Sample

    250110-khjh2a1mfl

  • MD5

    dfc81712a62d2f2852ea631060a9ee91

  • SHA1

    c6ed37c61d3b143e66b4abb53cccc4db1b0c61d1

  • SHA256

    3fe87dde7e2f707307d03115bf5aad1ad08ee11d8f9b4ce28579a54be834fbd6

  • SHA512

    1f3460a22cd25ed57056a4fae119ccf5ba983c4151b092759c84f30adeeb199b22af0a1caf5709f924b2b8190756aeca9757576ba95ed5bec705c5e3d393b832

  • SSDEEP

    24576:T2G/nvxW3W7/okMlI4tH7Da3x1VStiA7iw63VboDAJDyL+qq+aWTIN+4H:TbA3m/oosbwswq63IEUI

Score
10/10
dcratdiscoveryinfostealerpersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_dfc81712a62d2f2852ea631060a9ee91

    • Size

      1.5MB

    • MD5

      dfc81712a62d2f2852ea631060a9ee91

    • SHA1

      c6ed37c61d3b143e66b4abb53cccc4db1b0c61d1

    • SHA256

      3fe87dde7e2f707307d03115bf5aad1ad08ee11d8f9b4ce28579a54be834fbd6

    • SHA512

      1f3460a22cd25ed57056a4fae119ccf5ba983c4151b092759c84f30adeeb199b22af0a1caf5709f924b2b8190756aeca9757576ba95ed5bec705c5e3d393b832

    • SSDEEP

      24576:T2G/nvxW3W7/okMlI4tH7Da3x1VStiA7iw63VboDAJDyL+qq+aWTIN+4H:TbA3m/oosbwswq63IEUI

    Score
    10/10
    dcratdiscoveryinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks