Overview

overview

10

Static

static

dxkzp.dll

windows7_x64

10

dxkzp.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dxkzp.dll

  • Size

    836KB

  • Sample

    210121-dvzal1p8wx

  • MD5

    b987ba911cf1217e83778e71df3182c8

  • SHA1

    842bcedd76890326ca5552010c5c3dc9d0b4c0e7

  • SHA256

    a9653dacc87403855ff752ff34c6913f5c4f0aec5bfe2c83f95151c9e13d5ba4

  • SHA512

    ed5ed5028549ba0b9877b9524ad70e24e49c30fd43076e13bc20a8b92c3d7bdba11219607fd7487b6650842b02f4e22f723657491acafd292cb363232e069844

Score
10/10
dridex10444botnetloader

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

194.225.58.214:443

211.110.44.63:5353

69.164.207.140:3388

198.57.200.100:3786
rc4.plain
rc4.plain

Targets

    • Target

      dxkzp.dll

    • Size

      836KB

    • MD5

      b987ba911cf1217e83778e71df3182c8

    • SHA1

      842bcedd76890326ca5552010c5c3dc9d0b4c0e7

    • SHA256

      a9653dacc87403855ff752ff34c6913f5c4f0aec5bfe2c83f95151c9e13d5ba4

    • SHA512

      ed5ed5028549ba0b9877b9524ad70e24e49c30fd43076e13bc20a8b92c3d7bdba11219607fd7487b6650842b02f4e22f723657491acafd292cb363232e069844

    Score
    10/10
    dridex10444botnetloader

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

      botnetloader
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks