General
- Target 22ce9b4f200c32eeb293116301e97307.exe
- Size 2.7MB
- Sample260721-2cefkavejf
- SHA256 ad5a8f0a70678395eee394dbe48b2508784e06f37e7a980f4bd61599d180360d
Score
10/10
Malware Config
Targets
-
- Target 22ce9b4f200c32eeb293116301e97307.exe
- Size 2.7MB
- SHA256 ad5a8f0a70678395eee394dbe48b2508784e06f37e7a980f4bd61599d180360d
Score10/10-
DCRat payload
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE