General

  • Target

    d63beded771ab4503b39115c909eeda74d2209b2f1b7be04e96dda874abc496f

  • Size

    196KB

  • Sample

    210304-697x2f6vx2

  • MD5

    9461f52330a1162b01b978bfef3eb843

  • SHA1

    1132985644280b821bbf14b727cab6a602a371a0

  • SHA256

    d63beded771ab4503b39115c909eeda74d2209b2f1b7be04e96dda874abc496f

  • SHA512

    eaaedbc65b766656e35f5c47a3bcc9119ef2f483f7fa8e4ad18948e3e69de907605081b3cdb5bc688606482279837447d3b0e04bd94e0349d71d0033a2c9f647

Malware Config

Extracted

Family

dridex

Botnet

111

C2

37.247.35.132:443

50.243.30.51:6601

162.241.204.234:6516

rc4.plain
rc4.plain

Targets

    • Target

      d63beded771ab4503b39115c909eeda74d2209b2f1b7be04e96dda874abc496f

    • Size

      196KB

    • MD5

      9461f52330a1162b01b978bfef3eb843

    • SHA1

      1132985644280b821bbf14b727cab6a602a371a0

    • SHA256

      d63beded771ab4503b39115c909eeda74d2209b2f1b7be04e96dda874abc496f

    • SHA512

      eaaedbc65b766656e35f5c47a3bcc9119ef2f483f7fa8e4ad18948e3e69de907605081b3cdb5bc688606482279837447d3b0e04bd94e0349d71d0033a2c9f647

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks