Overview

overview

10

Static

static

10

dridex

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    07d90ae4f6cec95ad1aadecfc6d7a03dab1f6b681d8e4d3cc0ba0d19a7e3cba7

  • Size

    1.3MB

  • Sample

    221101-s2ctladag8

  • MD5

    366448628a27a5a99a1f734c1f4212d0

  • SHA1

    8797b455ca4859f1f63926a94ba76cc5207c00d4

  • SHA256

    07d90ae4f6cec95ad1aadecfc6d7a03dab1f6b681d8e4d3cc0ba0d19a7e3cba7

  • SHA512

    1b10af455b419831747d39d2e57e2e1d70ac65180be1cdb28788fdbf47e084306b6ea5960e3b8193330ce854c9c675a6f06bc9ba59fa25039450fb4f06c393ae

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      07d90ae4f6cec95ad1aadecfc6d7a03dab1f6b681d8e4d3cc0ba0d19a7e3cba7

    • Size

      1.3MB

    • MD5

      366448628a27a5a99a1f734c1f4212d0

    • SHA1

      8797b455ca4859f1f63926a94ba76cc5207c00d4

    • SHA256

      07d90ae4f6cec95ad1aadecfc6d7a03dab1f6b681d8e4d3cc0ba0d19a7e3cba7

    • SHA512

      1b10af455b419831747d39d2e57e2e1d70ac65180be1cdb28788fdbf47e084306b6ea5960e3b8193330ce854c9c675a6f06bc9ba59fa25039450fb4f06c393ae

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks