Overview

overview

10

Static

static

10

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ca8529da4c89f843d68818acc96b0dbf39348d9e456fd5d428b149afc0076205

  • Size

    1.3MB

  • Sample

    221102-ty2h8aacb7

  • MD5

    3a1bc91b0c3ce22e367bfa21b7fb507d

  • SHA1

    d8678e7609c57f208c674d8667a086e27a47e345

  • SHA256

    ca8529da4c89f843d68818acc96b0dbf39348d9e456fd5d428b149afc0076205

  • SHA512

    2524c3cb4a2b58b5f82444711390045d8886a110dbc862d5cd54fc4aa1a70055df4b9bcd4eb9f425b486e370b206a6ed009c0bd5a2e239f24ad86e379d36aadc

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      ca8529da4c89f843d68818acc96b0dbf39348d9e456fd5d428b149afc0076205

    • Size

      1.3MB

    • MD5

      3a1bc91b0c3ce22e367bfa21b7fb507d

    • SHA1

      d8678e7609c57f208c674d8667a086e27a47e345

    • SHA256

      ca8529da4c89f843d68818acc96b0dbf39348d9e456fd5d428b149afc0076205

    • SHA512

      2524c3cb4a2b58b5f82444711390045d8886a110dbc862d5cd54fc4aa1a70055df4b9bcd4eb9f425b486e370b206a6ed009c0bd5a2e239f24ad86e379d36aadc

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks