Overview

overview

10

Static

static

10

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2df82be0158d2029ee855de4b3ac90796d2ee83628b263146322b065ed6d77dd

  • Size

    1.3MB

  • Sample

    221101-k38cwsaba4

  • MD5

    abdb3803b2d0ace674f0cff7313cbe9e

  • SHA1

    02d57970a248b380113ef530fe74a877ba4a3d3a

  • SHA256

    2df82be0158d2029ee855de4b3ac90796d2ee83628b263146322b065ed6d77dd

  • SHA512

    694e8ac258fb35e9b8de4ffeabca5b898c5c585eb727144f5ecd2044aca8169cc7e95d63eefde852ce10ff945dbc4e8743a4556fdd74e7f8b370222237e60fba

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      2df82be0158d2029ee855de4b3ac90796d2ee83628b263146322b065ed6d77dd

    • Size

      1.3MB

    • MD5

      abdb3803b2d0ace674f0cff7313cbe9e

    • SHA1

      02d57970a248b380113ef530fe74a877ba4a3d3a

    • SHA256

      2df82be0158d2029ee855de4b3ac90796d2ee83628b263146322b065ed6d77dd

    • SHA512

      694e8ac258fb35e9b8de4ffeabca5b898c5c585eb727144f5ecd2044aca8169cc7e95d63eefde852ce10ff945dbc4e8743a4556fdd74e7f8b370222237e60fba

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks