Overview

overview

10

Static

static

dbea79eb7a...de.dll

windows7_x64

10

dbea79eb7a...de.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dbea79eb7a9d95e5a6ead73b7ddeb6a813e6268b8bed40b6b438037347a923de

  • Size

    188KB

  • Sample

    210303-xjfbfv6nvj

  • MD5

    851e9b7973676c8647c2619b49cd0cfe

  • SHA1

    a4ea103be3be9bd40e7e445a8ea0f9b127a530c0

  • SHA256

    dbea79eb7a9d95e5a6ead73b7ddeb6a813e6268b8bed40b6b438037347a923de

  • SHA512

    99126028d266f693b3e01602ae78e97498ab2c4f266f44ecc290f5adf4bb04653b7b265f50e8d52dee29ed33d1f88326abf68053193b1045cb5fa628a0b30204

Score
10/10
dridex111botnetdiscoveryevasionloadertrojan

Malware Config

Extracted

Family

dridex

Botnet

111

C2

116.251.211.158:443

216.10.242.142:6601

37.247.35.137:6601
rc4.plain
rc4.plain

Targets

    • Target

      dbea79eb7a9d95e5a6ead73b7ddeb6a813e6268b8bed40b6b438037347a923de

    • Size

      188KB

    • MD5

      851e9b7973676c8647c2619b49cd0cfe

    • SHA1

      a4ea103be3be9bd40e7e445a8ea0f9b127a530c0

    • SHA256

      dbea79eb7a9d95e5a6ead73b7ddeb6a813e6268b8bed40b6b438037347a923de

    • SHA512

      99126028d266f693b3e01602ae78e97498ab2c4f266f44ecc290f5adf4bb04653b7b265f50e8d52dee29ed33d1f88326abf68053193b1045cb5fa628a0b30204

    Score
    10/10
    dridex111botnetdiscoveryevasionloadertrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

      botnetloader

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks