Overview

overview

10

Static

static

10

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0ab4751f38e1e0e97d82a393b9a9a7e97560d02aef519bb34d2a648e03a1f448

  • Size

    1.3MB

  • Sample

    221101-pyra2achcr

  • MD5

    080beeb3dc9b38f075fa6f31168f560b

  • SHA1

    182ef2d103ca219abb4b1562e546b91ab48361c6

  • SHA256

    0ab4751f38e1e0e97d82a393b9a9a7e97560d02aef519bb34d2a648e03a1f448

  • SHA512

    3e3bb0e3daf0a95064e57251e7243c5b48b04bad3e608e51c2ecc87b86bfdea32a79e55145efc2bd20bb3ed58cd47597f3648f93af91903e1a5dfe3d1148e1dc

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      0ab4751f38e1e0e97d82a393b9a9a7e97560d02aef519bb34d2a648e03a1f448

    • Size

      1.3MB

    • MD5

      080beeb3dc9b38f075fa6f31168f560b

    • SHA1

      182ef2d103ca219abb4b1562e546b91ab48361c6

    • SHA256

      0ab4751f38e1e0e97d82a393b9a9a7e97560d02aef519bb34d2a648e03a1f448

    • SHA512

      3e3bb0e3daf0a95064e57251e7243c5b48b04bad3e608e51c2ecc87b86bfdea32a79e55145efc2bd20bb3ed58cd47597f3648f93af91903e1a5dfe3d1148e1dc

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks