Overview

overview

10

Static

static

10

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d7e7fe19455456fd02eff4b8d665866c9035fa9ef3f46dd3300859ca96164c07

  • Size

    1.3MB

  • Sample

    230203-kewzysdc24

  • MD5

    a7f763f9c750e622a05980ee74e77e82

  • SHA1

    f2338d69a6d993c31e6664b7d2387fc852e70952

  • SHA256

    d7e7fe19455456fd02eff4b8d665866c9035fa9ef3f46dd3300859ca96164c07

  • SHA512

    063bcdc88b32e293ad4e7c4cfca2e1472f4c67164f9ed6e4d959fb9b5e656b26ad2501b3ffd24bc6117fae4e5e5abdc8ef877a0f77e8873fb6763a634754ba33

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      d7e7fe19455456fd02eff4b8d665866c9035fa9ef3f46dd3300859ca96164c07

    • Size

      1.3MB

    • MD5

      a7f763f9c750e622a05980ee74e77e82

    • SHA1

      f2338d69a6d993c31e6664b7d2387fc852e70952

    • SHA256

      d7e7fe19455456fd02eff4b8d665866c9035fa9ef3f46dd3300859ca96164c07

    • SHA512

      063bcdc88b32e293ad4e7c4cfca2e1472f4c67164f9ed6e4d959fb9b5e656b26ad2501b3ffd24bc6117fae4e5e5abdc8ef877a0f77e8873fb6763a634754ba33

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks