Overview

overview

10

Static

static

10

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    1c730d491e0907e47e8d7b4bb98766ebbe8ad0a647cec0f35c447cffc8f2fe0b

  • Size

    1.3MB

  • Sample

    221101-dvtq7sgeer

  • MD5

    ba05753a5bc5f00912b73737937fd1ea

  • SHA1

    d6898c32ed7c201c92c4de0be8bd4427a743fc5f

  • SHA256

    1c730d491e0907e47e8d7b4bb98766ebbe8ad0a647cec0f35c447cffc8f2fe0b

  • SHA512

    619f9a905034bf177512c7406a196c027e2e541e021b33029464a28b479f81afbc0ca3613e42597be30977102d8e4ede86a87ce51035b7f1d11e2b76033fb0ca

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      1c730d491e0907e47e8d7b4bb98766ebbe8ad0a647cec0f35c447cffc8f2fe0b

    • Size

      1.3MB

    • MD5

      ba05753a5bc5f00912b73737937fd1ea

    • SHA1

      d6898c32ed7c201c92c4de0be8bd4427a743fc5f

    • SHA256

      1c730d491e0907e47e8d7b4bb98766ebbe8ad0a647cec0f35c447cffc8f2fe0b

    • SHA512

      619f9a905034bf177512c7406a196c027e2e541e021b33029464a28b479f81afbc0ca3613e42597be30977102d8e4ede86a87ce51035b7f1d11e2b76033fb0ca

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks