Overview

overview

10

Static

static

10

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    55d40cd8c837c10a74fb135e0973db85a553209117a67008f68582b5bbbcf02b

  • Size

    1.1MB

  • Sample

    230122-sf5bqaab6s

  • MD5

    f10fe10a538f342b001eb1c9ee3855f1

  • SHA1

    b52c40944c9a593ab5fb2bdb878c43f7f0f63361

  • SHA256

    55d40cd8c837c10a74fb135e0973db85a553209117a67008f68582b5bbbcf02b

  • SHA512

    c09ee1ff09a34ce6443e8b1505b52b334db742fad8545d8354b2ada8361fe07d00c7e9350160cb0cddb1a122d2c3c2355ecbe5058cb0939e2ebfda8a2b6612db

  • SSDEEP

    24576:U2G/nvxW3Ww0tWamzgLwLwTi7Pvezfsj088gN/aqEUIr2:UbA30WBujO+fsj0DIcUl

Score
10/10
dcratevasioninfostealerrat

Malware Config

Targets

    • Target

      55d40cd8c837c10a74fb135e0973db85a553209117a67008f68582b5bbbcf02b

    • Size

      1.1MB

    • MD5

      f10fe10a538f342b001eb1c9ee3855f1

    • SHA1

      b52c40944c9a593ab5fb2bdb878c43f7f0f63361

    • SHA256

      55d40cd8c837c10a74fb135e0973db85a553209117a67008f68582b5bbbcf02b

    • SHA512

      c09ee1ff09a34ce6443e8b1505b52b334db742fad8545d8354b2ada8361fe07d00c7e9350160cb0cddb1a122d2c3c2355ecbe5058cb0939e2ebfda8a2b6612db

    • SSDEEP

      24576:U2G/nvxW3Ww0tWamzgLwLwTi7Pvezfsj088gN/aqEUIr2:UbA30WBujO+fsj0DIcUl

    Score
    10/10
    dcratevasioninfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Disables Task Manager via registry modification

      evasion

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks