Overview

overview

10

Static

static

10

dridex

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    6da18a760686378730d42faa0095b4cc133d83c82560b461685aabb061151e0a

  • Size

    1.3MB

  • Sample

    221031-3kea7sebh7

  • MD5

    d3ffaa11ac289722de199f81e16753ed

  • SHA1

    eb471f003236e851fe1a944f581c04434af8d47f

  • SHA256

    6da18a760686378730d42faa0095b4cc133d83c82560b461685aabb061151e0a

  • SHA512

    b792927218c96b9c59c9af3bfb897e5e0236f5279f2ef152a89845878a857b373b99dd15c4ab0df80652d857a248fa763145c06d5b5d66ce598a89be4cdbcb8f

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      6da18a760686378730d42faa0095b4cc133d83c82560b461685aabb061151e0a

    • Size

      1.3MB

    • MD5

      d3ffaa11ac289722de199f81e16753ed

    • SHA1

      eb471f003236e851fe1a944f581c04434af8d47f

    • SHA256

      6da18a760686378730d42faa0095b4cc133d83c82560b461685aabb061151e0a

    • SHA512

      b792927218c96b9c59c9af3bfb897e5e0236f5279f2ef152a89845878a857b373b99dd15c4ab0df80652d857a248fa763145c06d5b5d66ce598a89be4cdbcb8f

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks