Overview

overview

10

Static

static

10

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    917250fc435b5c51c86c1e3ae15daa50a39dbfe10b2fc21a859ed82931da08eb

  • Size

    1.3MB

  • Sample

    221101-dtfsysfef6

  • MD5

    80a511cf460357fa67f354edf39581d8

  • SHA1

    6df262fc4b7139fbf5d86e861efbbadf05cf946f

  • SHA256

    917250fc435b5c51c86c1e3ae15daa50a39dbfe10b2fc21a859ed82931da08eb

  • SHA512

    d887b9b355fbc549e6fa427f5c1a5e1354220d62d98e0b61eb4100dfa8474415ca32425c0401f55f80a9a8b2c373b2d82da1b904036c3f2d2a269eedc804d5a5

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      917250fc435b5c51c86c1e3ae15daa50a39dbfe10b2fc21a859ed82931da08eb

    • Size

      1.3MB

    • MD5

      80a511cf460357fa67f354edf39581d8

    • SHA1

      6df262fc4b7139fbf5d86e861efbbadf05cf946f

    • SHA256

      917250fc435b5c51c86c1e3ae15daa50a39dbfe10b2fc21a859ed82931da08eb

    • SHA512

      d887b9b355fbc549e6fa427f5c1a5e1354220d62d98e0b61eb4100dfa8474415ca32425c0401f55f80a9a8b2c373b2d82da1b904036c3f2d2a269eedc804d5a5

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks