Overview

overview

10

Static

static

10

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    41b70239de876c386fbf96c53e9ca2300e8b1ed11973d1f8da82b0c92e39619c

  • Size

    1.3MB

  • Sample

    221031-y7ajbadehr

  • MD5

    d3d89e4e34ffc48d4dcd06c67783d24b

  • SHA1

    677a78c506146482dd98af932f49053a99ef5be0

  • SHA256

    41b70239de876c386fbf96c53e9ca2300e8b1ed11973d1f8da82b0c92e39619c

  • SHA512

    f11414f019cb878779faf9b7628835e8936147aef3c4e0c4c440a647b80d8ee3d09483b73939e72327af021dba811d0c52c8d2ae8213ad2f5ab88a39989ea576

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      41b70239de876c386fbf96c53e9ca2300e8b1ed11973d1f8da82b0c92e39619c

    • Size

      1.3MB

    • MD5

      d3d89e4e34ffc48d4dcd06c67783d24b

    • SHA1

      677a78c506146482dd98af932f49053a99ef5be0

    • SHA256

      41b70239de876c386fbf96c53e9ca2300e8b1ed11973d1f8da82b0c92e39619c

    • SHA512

      f11414f019cb878779faf9b7628835e8936147aef3c4e0c4c440a647b80d8ee3d09483b73939e72327af021dba811d0c52c8d2ae8213ad2f5ab88a39989ea576

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks