Overview

overview

10

Static

static

10

dridex

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    f166467ad1e1f6bd554e4cfeb9f36c9caa08f0e8407575353724fc0a388e4e61

  • Size

    1.3MB

  • Sample

    230203-hbtdjsca56

  • MD5

    05a2b44e63268e632214ef7e54505fd1

  • SHA1

    0ffcaf59b662dab311c919bf46b277e1dc9579f8

  • SHA256

    f166467ad1e1f6bd554e4cfeb9f36c9caa08f0e8407575353724fc0a388e4e61

  • SHA512

    7e1b2d31c8b6a29901863b113b573ecd347ff492b74044b28bf77dc57232828b1d2d091df61df713528eb56b516d0a027f6a0d3ea93b690e72a67fa0166ab654

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      f166467ad1e1f6bd554e4cfeb9f36c9caa08f0e8407575353724fc0a388e4e61

    • Size

      1.3MB

    • MD5

      05a2b44e63268e632214ef7e54505fd1

    • SHA1

      0ffcaf59b662dab311c919bf46b277e1dc9579f8

    • SHA256

      f166467ad1e1f6bd554e4cfeb9f36c9caa08f0e8407575353724fc0a388e4e61

    • SHA512

      7e1b2d31c8b6a29901863b113b573ecd347ff492b74044b28bf77dc57232828b1d2d091df61df713528eb56b516d0a027f6a0d3ea93b690e72a67fa0166ab654

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks