Overview

overview

10

Static

static

50e355dcec...dc.dll

windows7_x64

10

50e355dcec...dc.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    50e355dcec2acec8f48b032ed3bc8ee2e86b05809d15521f5437abf91cc74adc

  • Size

    188KB

  • Sample

    210303-twna6bacfs

  • MD5

    73be7951db89fc28134c0f2e084c84a7

  • SHA1

    7e32153ed9037c7cc6d24ec4768b1c375d4fc793

  • SHA256

    50e355dcec2acec8f48b032ed3bc8ee2e86b05809d15521f5437abf91cc74adc

  • SHA512

    acce72f9c95bdb0f2dc2328c0dd39d343a3bfaaa1cbafb062d2fe2935f2db6b323ba83e96c2137f08d02877f26522682a16de99dc7ca2da4c4d3148bbb2c87f4

Score
10/10
dridex111botnetdiscoveryevasionloadertrojan

Malware Config

Extracted

Family

dridex

Botnet

111

C2

116.251.211.158:443

216.10.242.142:6601

37.247.35.137:6601
rc4.plain
rc4.plain

Targets

    • Target

      50e355dcec2acec8f48b032ed3bc8ee2e86b05809d15521f5437abf91cc74adc

    • Size

      188KB

    • MD5

      73be7951db89fc28134c0f2e084c84a7

    • SHA1

      7e32153ed9037c7cc6d24ec4768b1c375d4fc793

    • SHA256

      50e355dcec2acec8f48b032ed3bc8ee2e86b05809d15521f5437abf91cc74adc

    • SHA512

      acce72f9c95bdb0f2dc2328c0dd39d343a3bfaaa1cbafb062d2fe2935f2db6b323ba83e96c2137f08d02877f26522682a16de99dc7ca2da4c4d3148bbb2c87f4

    Score
    10/10
    dridex111botnetdiscoveryevasionloadertrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

      botnetloader

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks