Overview

overview

10

Static

static

10

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2f043a4a5c4cfd4d9aedfc6816201f2741ea1bae0375d4d14a5a9c6bbfd11429

  • Size

    1.3MB

  • Sample

    221101-ad8bgsedd9

  • MD5

    6efd0000a95cc574d7a64a5fcf85fbe6

  • SHA1

    b49078c2adfe8d38ebc3a45e55beefa76a533c2c

  • SHA256

    2f043a4a5c4cfd4d9aedfc6816201f2741ea1bae0375d4d14a5a9c6bbfd11429

  • SHA512

    8f0f205fae5357f4295613ef02eddafabd7c555db75d96b223bffe5b854ea2e3073b864d75c2b219b6a44c48b35c981809e935ff12aed30be8dcd35f321ffa9e

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      2f043a4a5c4cfd4d9aedfc6816201f2741ea1bae0375d4d14a5a9c6bbfd11429

    • Size

      1.3MB

    • MD5

      6efd0000a95cc574d7a64a5fcf85fbe6

    • SHA1

      b49078c2adfe8d38ebc3a45e55beefa76a533c2c

    • SHA256

      2f043a4a5c4cfd4d9aedfc6816201f2741ea1bae0375d4d14a5a9c6bbfd11429

    • SHA512

      8f0f205fae5357f4295613ef02eddafabd7c555db75d96b223bffe5b854ea2e3073b864d75c2b219b6a44c48b35c981809e935ff12aed30be8dcd35f321ffa9e

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks