Overview

overview

10

Static

static

clax.exe

windows7_x64

10

clax.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    clax.exe

  • Size

    240KB

  • Sample

    201109-451gy6355a

  • MD5

    aeaacc4da7ea15de0224d4c3e3456ce0

  • SHA1

    365994b4255c68753b8972cc953c348926bb3207

  • SHA256

    f072b971950ba8a2e12c85501f0d63160f833df8411c5fa1cda8ac6261b27a2d

  • SHA512

    9fddc35a9c352c88903d02dc30de3647651eaa4438a1646d611bfa2d1c918c2f509d020c4e6805d5931f254c0da767903ebcdcb6d4f4ae513065a76c170b94f4

Score
10/10
dridex40400botnetloader

Malware Config

Extracted

Family

dridex

Botnet

40400

C2

178.128.83.136:443

138.122.143.41:8443

85.25.106.204:691

159.203.136.67:3308
rc4.plain
rc4.plain

Targets

    • Target

      clax.exe

    • Size

      240KB

    • MD5

      aeaacc4da7ea15de0224d4c3e3456ce0

    • SHA1

      365994b4255c68753b8972cc953c348926bb3207

    • SHA256

      f072b971950ba8a2e12c85501f0d63160f833df8411c5fa1cda8ac6261b27a2d

    • SHA512

      9fddc35a9c352c88903d02dc30de3647651eaa4438a1646d611bfa2d1c918c2f509d020c4e6805d5931f254c0da767903ebcdcb6d4f4ae513065a76c170b94f4

    Score
    10/10
    dridex40400botnetloader

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

      botnetloader
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks