Overview

overview

10

Static

static

10

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8028fee0ca6e499e3534853345c5f16845cd3cb79318b7130e67573ba2c63d95

  • Size

    1.3MB

  • Sample

    230202-rynw1shg6s

  • MD5

    118525751d185f9f042902eff8e721b2

  • SHA1

    081c726f63ea72d8df80a885474395a00c55fa5f

  • SHA256

    8028fee0ca6e499e3534853345c5f16845cd3cb79318b7130e67573ba2c63d95

  • SHA512

    56a3c87d55770b51e07523499792e803513711c7b49ffd2e1490915274c2ea9cbd14da5f495e0a1af2a985c6a287179fd528b68612f788720010480cace1a23a

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      8028fee0ca6e499e3534853345c5f16845cd3cb79318b7130e67573ba2c63d95

    • Size

      1.3MB

    • MD5

      118525751d185f9f042902eff8e721b2

    • SHA1

      081c726f63ea72d8df80a885474395a00c55fa5f

    • SHA256

      8028fee0ca6e499e3534853345c5f16845cd3cb79318b7130e67573ba2c63d95

    • SHA512

      56a3c87d55770b51e07523499792e803513711c7b49ffd2e1490915274c2ea9cbd14da5f495e0a1af2a985c6a287179fd528b68612f788720010480cace1a23a

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks