Overview

overview

10

Static

static

10

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    c191e244adb4d49acf8ddb2ca43141d3cf9dc6dff9f3dd4047c4599262d75e2a

  • Size

    1.3MB

  • Sample

    230203-mfylaahf9x

  • MD5

    3b46e353d8c8610bdde3957c56a133d1

  • SHA1

    1d9a89edca60e2a7a592b3680bdc6b164daf359b

  • SHA256

    c191e244adb4d49acf8ddb2ca43141d3cf9dc6dff9f3dd4047c4599262d75e2a

  • SHA512

    14bf5b24e09047348e3213091d0e70542ae616187764198a24fd2ccc8316adf6c6b69d58765c51bde41735e5128a09068f6f68292a5e01221df99a62a1860a95

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      c191e244adb4d49acf8ddb2ca43141d3cf9dc6dff9f3dd4047c4599262d75e2a

    • Size

      1.3MB

    • MD5

      3b46e353d8c8610bdde3957c56a133d1

    • SHA1

      1d9a89edca60e2a7a592b3680bdc6b164daf359b

    • SHA256

      c191e244adb4d49acf8ddb2ca43141d3cf9dc6dff9f3dd4047c4599262d75e2a

    • SHA512

      14bf5b24e09047348e3213091d0e70542ae616187764198a24fd2ccc8316adf6c6b69d58765c51bde41735e5128a09068f6f68292a5e01221df99a62a1860a95

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks