Overview

overview

10

Static

static

10

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a9538ad01ad86c26a62d12b50149d27cae7b2890c6a9982d25ec13ffab6eb36c

  • Size

    1.3MB

  • Sample

    230202-2xzx1abh9y

  • MD5

    80158f14a52f69f5bf47e1129b55c5f3

  • SHA1

    c360ec3b8e1f4200996f703c7984e2f4b3c191bc

  • SHA256

    a9538ad01ad86c26a62d12b50149d27cae7b2890c6a9982d25ec13ffab6eb36c

  • SHA512

    41b4ad419e780f9a8dacf13d24d4ed7e0c9ea09c54935e457310993ca2501d6af79e456b9f80e2f4ee09d424435aac4ff355550992bdebca83e45d62cf479938

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      a9538ad01ad86c26a62d12b50149d27cae7b2890c6a9982d25ec13ffab6eb36c

    • Size

      1.3MB

    • MD5

      80158f14a52f69f5bf47e1129b55c5f3

    • SHA1

      c360ec3b8e1f4200996f703c7984e2f4b3c191bc

    • SHA256

      a9538ad01ad86c26a62d12b50149d27cae7b2890c6a9982d25ec13ffab6eb36c

    • SHA512

      41b4ad419e780f9a8dacf13d24d4ed7e0c9ea09c54935e457310993ca2501d6af79e456b9f80e2f4ee09d424435aac4ff355550992bdebca83e45d62cf479938

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks