Overview

overview

10

Static

static

10

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a2ac94a35d03f22b8b85759206407f1d99fe3fbc56b8233e03cb5bf04f2b2c6f

  • Size

    1.3MB

  • Sample

    221102-m4t8rsbce4

  • MD5

    e853c9bb262713e89fbcf8ae5fe7835a

  • SHA1

    1477e6e0026eeb9639e6011ec4e1e04ac5ebbffd

  • SHA256

    a2ac94a35d03f22b8b85759206407f1d99fe3fbc56b8233e03cb5bf04f2b2c6f

  • SHA512

    a3c2a1e263adb437c1c076a6b5bb45b58d56396aa9884c7fb724f56c47b16c1d1d481df2b1746de3ed5c08816ed17e99734a34d7dae6c000c7b7adced946b1bf

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      a2ac94a35d03f22b8b85759206407f1d99fe3fbc56b8233e03cb5bf04f2b2c6f

    • Size

      1.3MB

    • MD5

      e853c9bb262713e89fbcf8ae5fe7835a

    • SHA1

      1477e6e0026eeb9639e6011ec4e1e04ac5ebbffd

    • SHA256

      a2ac94a35d03f22b8b85759206407f1d99fe3fbc56b8233e03cb5bf04f2b2c6f

    • SHA512

      a3c2a1e263adb437c1c076a6b5bb45b58d56396aa9884c7fb724f56c47b16c1d1d481df2b1746de3ed5c08816ed17e99734a34d7dae6c000c7b7adced946b1bf

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks