Overview

overview

10

Static

static

10

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    761b9299b779d915cd3f9784395a9037ebb0a0e46d8f914e5e8ca634b653beeb

  • Size

    1.3MB

  • Sample

    230203-lrd6cahc91

  • MD5

    aed2b0968a411c5b31b08d3bb9590c40

  • SHA1

    e40669d52a62a03f0dda05d5b197548d4e7f7c8e

  • SHA256

    761b9299b779d915cd3f9784395a9037ebb0a0e46d8f914e5e8ca634b653beeb

  • SHA512

    80e4dc71dc87f0ee09c0c82358d02d40a0df80e207e2857979101e45e22c848ab217ddefef0e09ed3e4ac17a55fd234709ab97f4b1798ee682e5ec4ae84d6c8e

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      761b9299b779d915cd3f9784395a9037ebb0a0e46d8f914e5e8ca634b653beeb

    • Size

      1.3MB

    • MD5

      aed2b0968a411c5b31b08d3bb9590c40

    • SHA1

      e40669d52a62a03f0dda05d5b197548d4e7f7c8e

    • SHA256

      761b9299b779d915cd3f9784395a9037ebb0a0e46d8f914e5e8ca634b653beeb

    • SHA512

      80e4dc71dc87f0ee09c0c82358d02d40a0df80e207e2857979101e45e22c848ab217ddefef0e09ed3e4ac17a55fd234709ab97f4b1798ee682e5ec4ae84d6c8e

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks