Overview

overview

10

Static

static

10

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8f64f40676fb2de2e8d4c0895b8b63dc2d5df5450bd5bc19cb4f3697993b608a

  • Size

    1.3MB

  • Sample

    230203-fwckesee3w

  • MD5

    ab0fb62b16ab5d4d4b7d31ed83953e32

  • SHA1

    ac43890879a83e7d013cfd197173dfe300e55e88

  • SHA256

    8f64f40676fb2de2e8d4c0895b8b63dc2d5df5450bd5bc19cb4f3697993b608a

  • SHA512

    c92dee8e0e9a4acc36cc24e6a2ac3b70b101efcd931385bb8f5fbb93ef3b941ee59d7ede28e2e5312eaa4754a7dfbf20b10bed833a0b6424007eb3bb1155ed8b

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      8f64f40676fb2de2e8d4c0895b8b63dc2d5df5450bd5bc19cb4f3697993b608a

    • Size

      1.3MB

    • MD5

      ab0fb62b16ab5d4d4b7d31ed83953e32

    • SHA1

      ac43890879a83e7d013cfd197173dfe300e55e88

    • SHA256

      8f64f40676fb2de2e8d4c0895b8b63dc2d5df5450bd5bc19cb4f3697993b608a

    • SHA512

      c92dee8e0e9a4acc36cc24e6a2ac3b70b101efcd931385bb8f5fbb93ef3b941ee59d7ede28e2e5312eaa4754a7dfbf20b10bed833a0b6424007eb3bb1155ed8b

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks