Overview

overview

10

Static

static

10

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    30b1dc92d2ac80507f032810549a063ef147f43ec940dd8cbe507690c99815e8

  • Size

    1.3MB

  • Sample

    230203-hpdj9afe6t

  • MD5

    ae9b22e20840746a8cb0a04c7aca75a1

  • SHA1

    4b7bdb3a2a0b6f39355a28e22cd13317635a6f5b

  • SHA256

    30b1dc92d2ac80507f032810549a063ef147f43ec940dd8cbe507690c99815e8

  • SHA512

    af63315d05689698bf5ad8556ca3471c39d3c194117a6079a66aae75b1c3914bf2a53eaa23369ccaae7d6775316de6166fb485a1ba2653d716d610383849aa4a

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      30b1dc92d2ac80507f032810549a063ef147f43ec940dd8cbe507690c99815e8

    • Size

      1.3MB

    • MD5

      ae9b22e20840746a8cb0a04c7aca75a1

    • SHA1

      4b7bdb3a2a0b6f39355a28e22cd13317635a6f5b

    • SHA256

      30b1dc92d2ac80507f032810549a063ef147f43ec940dd8cbe507690c99815e8

    • SHA512

      af63315d05689698bf5ad8556ca3471c39d3c194117a6079a66aae75b1c3914bf2a53eaa23369ccaae7d6775316de6166fb485a1ba2653d716d610383849aa4a

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks