Overview

overview

10

Static

static

6

HF840TfNngNdGR.dll

windows7_x64

10

HF840TfNngNdGR.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    HF840TfNngNdGR.dll

  • Size

    236KB

  • Sample

    210114-7rp28azp2j

  • MD5

    7c1122d7e5da522d4f8c02bf6629e671

  • SHA1

    13e7167f33c7f62f4af659b7c2a89fe4cde32c9d

  • SHA256

    e2c92cc669abc7429b5dc2adc1ead88b058efd5d13d5a1156683149a6cfc2620

  • SHA512

    8baca41a955f00ab689ea9b548b69821d3d6058ead25d23efa1ab28aa64430b9fee4a82e8050485319fecfda96d29431daf6fbf6f21af3aa10f1a5b5dabf2894

Score
10/10
dridex111botnetloader

Malware Config

Extracted

Family

dridex

Botnet

111

C2

52.73.70.149:443

8.4.9.152:3786

185.246.87.202:3098

50.116.111.64:5353
rc4.plain
rc4.plain

Targets

    • Target

      HF840TfNngNdGR.dll

    • Size

      236KB

    • MD5

      7c1122d7e5da522d4f8c02bf6629e671

    • SHA1

      13e7167f33c7f62f4af659b7c2a89fe4cde32c9d

    • SHA256

      e2c92cc669abc7429b5dc2adc1ead88b058efd5d13d5a1156683149a6cfc2620

    • SHA512

      8baca41a955f00ab689ea9b548b69821d3d6058ead25d23efa1ab28aa64430b9fee4a82e8050485319fecfda96d29431daf6fbf6f21af3aa10f1a5b5dabf2894

    Score
    10/10
    dridex111botnetloader

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

      botnetloader
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks