Overview

overview

10

Static

static

bd37232c2e...a0.dll

windows7_x64

10

bd37232c2e...a0.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bd37232c2ec9e70b50f0cfee7260cb84c311ba2dbd8e789cfac3bc229b1b6ea0

  • Size

    188KB

  • Sample

    210303-nr6g2ag6t2

  • MD5

    11a01926899f14d0949405c71b0f6146

  • SHA1

    d075ad0c7cc871d40aca2bf1fa6db034547ced3a

  • SHA256

    bd37232c2ec9e70b50f0cfee7260cb84c311ba2dbd8e789cfac3bc229b1b6ea0

  • SHA512

    675928d88feac1780182fdc45cb9e35f002a1787d0aa93b7b5f93e675ffad55ef4fd0ae7a189a14ad5cbc1017735150698649534ed6f2300577834cc9945e9b4

Score
10/10
dridex111botnetdiscoveryevasionloadertrojan

Malware Config

Extracted

Family

dridex

Botnet

111

C2

116.251.211.158:443

216.10.242.142:6601

37.247.35.137:6601
rc4.plain
rc4.plain

Targets

    • Target

      bd37232c2ec9e70b50f0cfee7260cb84c311ba2dbd8e789cfac3bc229b1b6ea0

    • Size

      188KB

    • MD5

      11a01926899f14d0949405c71b0f6146

    • SHA1

      d075ad0c7cc871d40aca2bf1fa6db034547ced3a

    • SHA256

      bd37232c2ec9e70b50f0cfee7260cb84c311ba2dbd8e789cfac3bc229b1b6ea0

    • SHA512

      675928d88feac1780182fdc45cb9e35f002a1787d0aa93b7b5f93e675ffad55ef4fd0ae7a189a14ad5cbc1017735150698649534ed6f2300577834cc9945e9b4

    Score
    10/10
    dridex111botnetdiscoveryevasionloadertrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

      botnetloader

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks