Overview

overview

10

Static

static

10

dridex

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    3fe38bf7d228f7e96711ae1bc47441931fa2b6f4111eeaa1c8d2360e9692e363

  • Size

    1.3MB

  • Sample

    221102-gzcj9shgh2

  • MD5

    2ec8c0f7c3e166dff0cd2189cd272989

  • SHA1

    27692a4532b23adb798c914a8dc7c98bd53aa175

  • SHA256

    3fe38bf7d228f7e96711ae1bc47441931fa2b6f4111eeaa1c8d2360e9692e363

  • SHA512

    ddb5c817eea05c98c074a98abf5c47cff1109f314a982fe4d8dee71150fc00b593570ea223a61194e628b7c556fa2e3d78a631cbb3b8343d61bfeceb6301e86a

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      3fe38bf7d228f7e96711ae1bc47441931fa2b6f4111eeaa1c8d2360e9692e363

    • Size

      1.3MB

    • MD5

      2ec8c0f7c3e166dff0cd2189cd272989

    • SHA1

      27692a4532b23adb798c914a8dc7c98bd53aa175

    • SHA256

      3fe38bf7d228f7e96711ae1bc47441931fa2b6f4111eeaa1c8d2360e9692e363

    • SHA512

      ddb5c817eea05c98c074a98abf5c47cff1109f314a982fe4d8dee71150fc00b593570ea223a61194e628b7c556fa2e3d78a631cbb3b8343d61bfeceb6301e86a

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks