Overview

overview

10

Static

static

gmt6s0o.zip.dll

windows7_x64

10

gmt6s0o.zip.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    gmt6s0o.zip.dll

  • Size

    551KB

  • Sample

    201112-4c2rgmjjn6

  • MD5

    2eb6f6ca25507f8f9fce5b724d80800d

  • SHA1

    3528c55c3bb19b279de9c4ee847953d50b8918ff

  • SHA256

    f72bbba2814630af977b32b71152e7b499a9d154ad2aba5f4b8837081af9ac80

  • SHA512

    dc4989915fd2c3b25211762a9ddd340c52d9cd4396c2084276bb9b91a1aabff892708342fe3d64d8b17032074b26a2ba51eb63717bcbb06df728f8c956f3eb76

Score
10/10
dridex10555botnetdiscoveryevasionloadertrojan

Malware Config

Extracted

Family

dridex

Botnet

10555

C2

77.220.64.39:443

69.164.207.140:3388

78.47.139.43:4443

103.244.206.74:33443
rc4.plain
rc4.plain

Targets

    • Target

      gmt6s0o.zip.dll

    • Size

      551KB

    • MD5

      2eb6f6ca25507f8f9fce5b724d80800d

    • SHA1

      3528c55c3bb19b279de9c4ee847953d50b8918ff

    • SHA256

      f72bbba2814630af977b32b71152e7b499a9d154ad2aba5f4b8837081af9ac80

    • SHA512

      dc4989915fd2c3b25211762a9ddd340c52d9cd4396c2084276bb9b91a1aabff892708342fe3d64d8b17032074b26a2ba51eb63717bcbb06df728f8c956f3eb76

    Score
    10/10
    dridex10555botnetdiscoveryevasionloadertrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

      botnetloader

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks