Overview

overview

10

Static

static

10

dridex

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    62ce89dd14e660a9a09e14c5bfe7853a7cdc8c2fdb39c77e7a836fdb8a0fff19

  • Size

    1.3MB

  • Sample

    221102-rgmbvshda5

  • MD5

    69094a039cf779514f2bacc75c1510e9

  • SHA1

    2af42211b2768a82d72dd4567a0b225145d603e4

  • SHA256

    62ce89dd14e660a9a09e14c5bfe7853a7cdc8c2fdb39c77e7a836fdb8a0fff19

  • SHA512

    90a3196ffaf9f9147472d9d5ff09394898a5702f79ca65d8e3569032047ae19826f72a9179ceef680a1e4b8c36a4adb1f197a1804b455e2095d9ddd736b73910

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      62ce89dd14e660a9a09e14c5bfe7853a7cdc8c2fdb39c77e7a836fdb8a0fff19

    • Size

      1.3MB

    • MD5

      69094a039cf779514f2bacc75c1510e9

    • SHA1

      2af42211b2768a82d72dd4567a0b225145d603e4

    • SHA256

      62ce89dd14e660a9a09e14c5bfe7853a7cdc8c2fdb39c77e7a836fdb8a0fff19

    • SHA512

      90a3196ffaf9f9147472d9d5ff09394898a5702f79ca65d8e3569032047ae19826f72a9179ceef680a1e4b8c36a4adb1f197a1804b455e2095d9ddd736b73910

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks