Overview

overview

10

Static

static

10

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    911070e32e23fffa7454f9ede0a7ac8bab328947e925e1319ed0c0a761c01f6a

  • Size

    1.3MB

  • Sample

    230203-ag68lahb67

  • MD5

    41ca82152298906aa3012dc60d7d76aa

  • SHA1

    0949342c7ff25f7a3ac2b19bbded00b580ed83cb

  • SHA256

    911070e32e23fffa7454f9ede0a7ac8bab328947e925e1319ed0c0a761c01f6a

  • SHA512

    7cd3c8358eabc1efadd135d4624a3bb027df7410ce2658a92c7bba0f0dd859bb38b96ac37d236fc970e0d57eb963e34fbe951a16ecf71b7f283f0a6877a7c733

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      911070e32e23fffa7454f9ede0a7ac8bab328947e925e1319ed0c0a761c01f6a

    • Size

      1.3MB

    • MD5

      41ca82152298906aa3012dc60d7d76aa

    • SHA1

      0949342c7ff25f7a3ac2b19bbded00b580ed83cb

    • SHA256

      911070e32e23fffa7454f9ede0a7ac8bab328947e925e1319ed0c0a761c01f6a

    • SHA512

      7cd3c8358eabc1efadd135d4624a3bb027df7410ce2658a92c7bba0f0dd859bb38b96ac37d236fc970e0d57eb963e34fbe951a16ecf71b7f283f0a6877a7c733

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks