Overview

overview

10

Static

static

10

dridex

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    fabe18e94aac63cad3691185fd8b57e5c6ccadcf3352b354a7e3a9f2bd38abfd

  • Size

    1.3MB

  • Sample

    221102-f7vkdaachr

  • MD5

    34b9c7b3d43acf06be2b96176910c8f1

  • SHA1

    43fbd3a61598012cef4580c2b121282621b448b5

  • SHA256

    fabe18e94aac63cad3691185fd8b57e5c6ccadcf3352b354a7e3a9f2bd38abfd

  • SHA512

    034c87e3ba77ec25ff1f09865327c3c453c447bb3704e3e5a3f3d022c12c56272e788bad3bdb2dc82ed3b715dcc2c0581ce9ec74f94c941ea04530051bf80e19

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      fabe18e94aac63cad3691185fd8b57e5c6ccadcf3352b354a7e3a9f2bd38abfd

    • Size

      1.3MB

    • MD5

      34b9c7b3d43acf06be2b96176910c8f1

    • SHA1

      43fbd3a61598012cef4580c2b121282621b448b5

    • SHA256

      fabe18e94aac63cad3691185fd8b57e5c6ccadcf3352b354a7e3a9f2bd38abfd

    • SHA512

      034c87e3ba77ec25ff1f09865327c3c453c447bb3704e3e5a3f3d022c12c56272e788bad3bdb2dc82ed3b715dcc2c0581ce9ec74f94c941ea04530051bf80e19

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks