Overview

overview

10

Static

static

3cce3c32cb...34.dll

windows7_x64

10

3cce3c32cb...34.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3cce3c32cb8449ed92cfbb0ded1978ba4b20b2be19c4f5ede41fda0373bacb34

  • Size

    188KB

  • Sample

    210303-jzq1h9tmd2

  • MD5

    008b0f32711c4cb3f2207b46833d1028

  • SHA1

    26b492c6025cdfc91fcb8f485597922b6516f8de

  • SHA256

    3cce3c32cb8449ed92cfbb0ded1978ba4b20b2be19c4f5ede41fda0373bacb34

  • SHA512

    7fbaa2afac48dd0829e3d4dc97f3f778fdff49606afc527cf1f8f41163fa608ab01f1caa1796d87e3237eca01f93c34fa27351db8b4d315c9dea5b8eb756d06b

Score
10/10
dridex111botnetdiscoveryevasionloadertrojan

Malware Config

Extracted

Family

dridex

Botnet

111

C2

116.251.211.158:443

216.10.242.142:6601

37.247.35.137:6601
rc4.plain
rc4.plain

Targets

    • Target

      3cce3c32cb8449ed92cfbb0ded1978ba4b20b2be19c4f5ede41fda0373bacb34

    • Size

      188KB

    • MD5

      008b0f32711c4cb3f2207b46833d1028

    • SHA1

      26b492c6025cdfc91fcb8f485597922b6516f8de

    • SHA256

      3cce3c32cb8449ed92cfbb0ded1978ba4b20b2be19c4f5ede41fda0373bacb34

    • SHA512

      7fbaa2afac48dd0829e3d4dc97f3f778fdff49606afc527cf1f8f41163fa608ab01f1caa1796d87e3237eca01f93c34fa27351db8b4d315c9dea5b8eb756d06b

    Score
    10/10
    dridex111botnetdiscoveryevasionloadertrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

      botnetloader

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks