Overview

overview

10

Static

static

10

dridex

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    60fdb38fec27f8a769cda8949294783d1559031cdecb230676bb6db228a472dc

  • Size

    1.3MB

  • Sample

    221103-ge125aehc2

  • MD5

    12603d7fb1338ca0f68ae74f4d4d9f6b

  • SHA1

    63200a37da667f44ad85e3136fb38a78cd4a8f83

  • SHA256

    60fdb38fec27f8a769cda8949294783d1559031cdecb230676bb6db228a472dc

  • SHA512

    276c82682e7aee9f1f66fd4c58b765d9ae4f1b7fbc249e3457ab8f3c71db4ade618d8b222cab90f94f15750890caa92b702fe0bf2a07ad07b809696904d21797

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      60fdb38fec27f8a769cda8949294783d1559031cdecb230676bb6db228a472dc

    • Size

      1.3MB

    • MD5

      12603d7fb1338ca0f68ae74f4d4d9f6b

    • SHA1

      63200a37da667f44ad85e3136fb38a78cd4a8f83

    • SHA256

      60fdb38fec27f8a769cda8949294783d1559031cdecb230676bb6db228a472dc

    • SHA512

      276c82682e7aee9f1f66fd4c58b765d9ae4f1b7fbc249e3457ab8f3c71db4ade618d8b222cab90f94f15750890caa92b702fe0bf2a07ad07b809696904d21797

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks