Overview

overview

10

Static

static

10

dridex

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    452a4a7ec9397cdd92d5f0d7d033d6600967e408085d1587566e80dcea9f2099

  • Size

    1.3MB

  • Sample

    230203-jys7qsch89

  • MD5

    dc11ec12721e2e6f74756c65c06037be

  • SHA1

    e2890974f40c8d61882edba0509e8392394f4061

  • SHA256

    452a4a7ec9397cdd92d5f0d7d033d6600967e408085d1587566e80dcea9f2099

  • SHA512

    63f6d4271fbab8ef904b8107ee82a64ab189097c1294d0cf82c6b52eac97766e6d5a6cf4f63854980ef452e9677bde05ef78e0e23ba80389cb327eff9cd1f772

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      452a4a7ec9397cdd92d5f0d7d033d6600967e408085d1587566e80dcea9f2099

    • Size

      1.3MB

    • MD5

      dc11ec12721e2e6f74756c65c06037be

    • SHA1

      e2890974f40c8d61882edba0509e8392394f4061

    • SHA256

      452a4a7ec9397cdd92d5f0d7d033d6600967e408085d1587566e80dcea9f2099

    • SHA512

      63f6d4271fbab8ef904b8107ee82a64ab189097c1294d0cf82c6b52eac97766e6d5a6cf4f63854980ef452e9677bde05ef78e0e23ba80389cb327eff9cd1f772

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks