Overview

overview

10

Static

static

10

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    75c5f6515c4bbdf88e69a93b1ae54f466d5fccd05c14a9e5ad98604c55b2a02f

  • Size

    1.3MB

  • Sample

    221031-z7dfmseagn

  • MD5

    ea909b7f92ddb3aa9752c4800b89df3b

  • SHA1

    a6a552957d2562250b520837df8b807b51f1960b

  • SHA256

    75c5f6515c4bbdf88e69a93b1ae54f466d5fccd05c14a9e5ad98604c55b2a02f

  • SHA512

    c4cf944390ab1c9027d1a3eb6c78342363223f03987ef99138787228e9c051610feb1bf5a630a1ae79c42954c4bac4f39c2bf3d5513cc9ccf5b3a72af3707136

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      75c5f6515c4bbdf88e69a93b1ae54f466d5fccd05c14a9e5ad98604c55b2a02f

    • Size

      1.3MB

    • MD5

      ea909b7f92ddb3aa9752c4800b89df3b

    • SHA1

      a6a552957d2562250b520837df8b807b51f1960b

    • SHA256

      75c5f6515c4bbdf88e69a93b1ae54f466d5fccd05c14a9e5ad98604c55b2a02f

    • SHA512

      c4cf944390ab1c9027d1a3eb6c78342363223f03987ef99138787228e9c051610feb1bf5a630a1ae79c42954c4bac4f39c2bf3d5513cc9ccf5b3a72af3707136

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks