General
-
Target
428bdccd4c240a253810e1c2a4ff8b78.exe
-
Size
827KB
-
Sample
240630-hfreravbjb
-
MD5
428bdccd4c240a253810e1c2a4ff8b78
-
SHA1
6cb81ccde6f9cd26b0b60ce5b5d948dbda609c8c
-
SHA256
b9565d219fb7879e482bfc859721acc5e10edadb73a9bb6eb3190e58e45bea5d
-
SHA512
81619bed44fca74f7c9cd3dc7fef9d52cea24ea4d6ea5cf3eedbe25c9a3f16f12889ff30644371146f8d55a280ed2e6b730c69c50bf2b944c74cc6d7914d1a63
-
SSDEEP
12288:GurCqcV04iJuX03lJmrw1DMVMkNcL4uhB6lg1npjzh/Ta6:bypiJOw1D8YhB6lkpjdO6
Behavioral task
behavioral1
Sample
428bdccd4c240a253810e1c2a4ff8b78.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
428bdccd4c240a253810e1c2a4ff8b78.exe
Resource
win10v2004-20240611-en
Malware Config
Targets
-
-
Target
428bdccd4c240a253810e1c2a4ff8b78.exe
-
Size
827KB
-
MD5
428bdccd4c240a253810e1c2a4ff8b78
-
SHA1
6cb81ccde6f9cd26b0b60ce5b5d948dbda609c8c
-
SHA256
b9565d219fb7879e482bfc859721acc5e10edadb73a9bb6eb3190e58e45bea5d
-
SHA512
81619bed44fca74f7c9cd3dc7fef9d52cea24ea4d6ea5cf3eedbe25c9a3f16f12889ff30644371146f8d55a280ed2e6b730c69c50bf2b944c74cc6d7914d1a63
-
SSDEEP
12288:GurCqcV04iJuX03lJmrw1DMVMkNcL4uhB6lg1npjzh/Ta6:bypiJOw1D8YhB6lkpjdO6
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-