Overview

overview

10

Static

static

2a3b44951f...4a.dll

windows7_x64

10

2a3b44951f...4a.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2a3b44951f8e7d31396dd12f547480f5718727ae606e0ba3355e69bb0a98d14a

  • Size

    188KB

  • Sample

    210303-xc3fdpvkd2

  • MD5

    46351211153c18d2a8176c8f673cc3cd

  • SHA1

    649e8eaf1fecceb7c696a2a27aca9eba19f18e78

  • SHA256

    2a3b44951f8e7d31396dd12f547480f5718727ae606e0ba3355e69bb0a98d14a

  • SHA512

    b2b9fe896555282f1f5c1a2c19c78aec3568f4b8fbdd64bf420ea9b3cc8e5fe53ddf8903e6d375c366b4a8e8d800741b7c0174c28f8518338629c5c577d9d73f

Score
10/10
dridex111botnetdiscoveryevasionloadertrojan

Malware Config

Extracted

Family

dridex

Botnet

111

C2

116.251.211.158:443

216.10.242.142:6601

37.247.35.137:6601
rc4.plain
rc4.plain

Targets

    • Target

      2a3b44951f8e7d31396dd12f547480f5718727ae606e0ba3355e69bb0a98d14a

    • Size

      188KB

    • MD5

      46351211153c18d2a8176c8f673cc3cd

    • SHA1

      649e8eaf1fecceb7c696a2a27aca9eba19f18e78

    • SHA256

      2a3b44951f8e7d31396dd12f547480f5718727ae606e0ba3355e69bb0a98d14a

    • SHA512

      b2b9fe896555282f1f5c1a2c19c78aec3568f4b8fbdd64bf420ea9b3cc8e5fe53ddf8903e6d375c366b4a8e8d800741b7c0174c28f8518338629c5c577d9d73f

    Score
    10/10
    dridex111botnetdiscoveryevasionloadertrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

      botnetloader

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks