dridex | b6ab3011a740ead047ff5bdb242fff77cbc3c5cbee2757c1ab8f830ceaef24c9 | Triage

Sharing

General

Target

b6ab3011a740ead047ff5bdb242fff77cbc3c5cbee2757c1ab8f830ceaef24c9
Size

165KB
MD5

eb2a6b15ae783a06f63b258e6b1b5dea
SHA1

c6a15516ba0a987a71032522bbbb345d379001ac
SHA256

b6ab3011a740ead047ff5bdb242fff77cbc3c5cbee2757c1ab8f830ceaef24c9
SHA512

b54bdada86e7995ef6d1ce9b22ef5488254774a32b057f28a4672c884b4abf7e87a6957c67790f1f0b6f7230f9e94c4663c02f28d478236f611516868773cc1d

Score

10^/10

botnet loader dridex

Malware Config

Extracted

Family

dridex

Version

10555

C2

199.66.90.63:443

85.214.26.7:3389

51.68.224.245:4646

107.175.87.150:3889

rc4.plain

rc4.plain

Signatures

Dridex Loader 1 IoCs
Detects Dridex both x86 and x64 loader in memory.
botnet loader

Processes:

resource yara_rule

sample dridex_ldr
Dridex Loader 'dmod' strings 1 IoCs
Detects 'dmod' strings in Dridex loader.
botnet loader

Processes:

resource yara_rule

sample dridex_ldr_dmod
Dridex family
dridex

Files

b6ab3011a740ead047ff5bdb242fff77cbc3c5cbee2757c1ab8f830ceaef24c9
.dll windows x86 regsvr32

Exports

Exports

DllRegisterServer