Overview

overview

10

Static

static

10

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    993d6a31a0cf5809f0fbecf8ff45660c92159639348510d170d2a2e5575fb32b

  • Size

    1.3MB

  • Sample

    221101-pc573acfhl

  • MD5

    102ac8ccd8a5a0cffe8eb92d826a88ac

  • SHA1

    1f5aca67bc02c9bab412489c53f52b68856b6c5e

  • SHA256

    993d6a31a0cf5809f0fbecf8ff45660c92159639348510d170d2a2e5575fb32b

  • SHA512

    89446d60274f416bc9dfc71dde33461d62c84a8011d9739e70c3746f1adff8858ce6a7753f11a2904ec4612aa955b952beee822e60724b5055dbcabcbaf9bf4f

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      993d6a31a0cf5809f0fbecf8ff45660c92159639348510d170d2a2e5575fb32b

    • Size

      1.3MB

    • MD5

      102ac8ccd8a5a0cffe8eb92d826a88ac

    • SHA1

      1f5aca67bc02c9bab412489c53f52b68856b6c5e

    • SHA256

      993d6a31a0cf5809f0fbecf8ff45660c92159639348510d170d2a2e5575fb32b

    • SHA512

      89446d60274f416bc9dfc71dde33461d62c84a8011d9739e70c3746f1adff8858ce6a7753f11a2904ec4612aa955b952beee822e60724b5055dbcabcbaf9bf4f

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks