Overview

overview

10

Static

static

10

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8f17592d2a9ecfa26e7ece4132c9f073f5e2c91fc909f4eb58524b0f186275d7

  • Size

    1.3MB

  • Sample

    230202-xen1kagd3v

  • MD5

    1f29e3e88ff8b020a028de82e87a06fe

  • SHA1

    a57cb68221ae3a53cb9da6d8e34bedd0ca0f5ee7

  • SHA256

    8f17592d2a9ecfa26e7ece4132c9f073f5e2c91fc909f4eb58524b0f186275d7

  • SHA512

    133259fadaeb3f44e83e53136e89f597fd4e891098e23ff5a8d9974dfb533b1a143f07ff2691a12d462b4c982634e6ab318a76c3a1180c8d7cc72042f0ac1212

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      8f17592d2a9ecfa26e7ece4132c9f073f5e2c91fc909f4eb58524b0f186275d7

    • Size

      1.3MB

    • MD5

      1f29e3e88ff8b020a028de82e87a06fe

    • SHA1

      a57cb68221ae3a53cb9da6d8e34bedd0ca0f5ee7

    • SHA256

      8f17592d2a9ecfa26e7ece4132c9f073f5e2c91fc909f4eb58524b0f186275d7

    • SHA512

      133259fadaeb3f44e83e53136e89f597fd4e891098e23ff5a8d9974dfb533b1a143f07ff2691a12d462b4c982634e6ab318a76c3a1180c8d7cc72042f0ac1212

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks