Overview

overview

10

Static

static

10

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    3b7e4dbd6682156fd7be8bc4ab601e4a0d1391e71a1886871a6871f4101ba9c7

  • Size

    1.3MB

  • Sample

    221102-k3xldsbddr

  • MD5

    b88b0d105627071613e627c3ef7fd4ce

  • SHA1

    4cbdf04ab2fd484d670996c8e7bd292b189bfa20

  • SHA256

    3b7e4dbd6682156fd7be8bc4ab601e4a0d1391e71a1886871a6871f4101ba9c7

  • SHA512

    638b7f27114b2f155e5bf1a90e6b3564c446f59f842e89eabf545b75275698bb8f8f54aea63814eefc4382383a333b44e3837737d780f6893c7a6b93f5d3d818

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      3b7e4dbd6682156fd7be8bc4ab601e4a0d1391e71a1886871a6871f4101ba9c7

    • Size

      1.3MB

    • MD5

      b88b0d105627071613e627c3ef7fd4ce

    • SHA1

      4cbdf04ab2fd484d670996c8e7bd292b189bfa20

    • SHA256

      3b7e4dbd6682156fd7be8bc4ab601e4a0d1391e71a1886871a6871f4101ba9c7

    • SHA512

      638b7f27114b2f155e5bf1a90e6b3564c446f59f842e89eabf545b75275698bb8f8f54aea63814eefc4382383a333b44e3837737d780f6893c7a6b93f5d3d818

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks