General

  • Target

    5e05c4e375a9d930b9b6cb5d1a00d4e032ef1fae7573dbd4bb4a798b351e3b02

  • Size

    196KB

  • Sample

    210304-cyx74saxb6

  • MD5

    f033bcd9080caa7841c8949f1cae59c1

  • SHA1

    e521741442ec2513203a1f1744484d36ac0888f8

  • SHA256

    5e05c4e375a9d930b9b6cb5d1a00d4e032ef1fae7573dbd4bb4a798b351e3b02

  • SHA512

    ccc3e0ac1ea2097030d9d70de8719391e4ebfd9e8902898a41a12f0cbf2a1c35f55204c6ca5b521ae2615644d6abfc4e50bc282241c4afff4870383f9fc790e9

Malware Config

Extracted

Family

dridex

Botnet

111

C2

37.247.35.132:443

50.243.30.51:6601

162.241.204.234:6516

rc4.plain
rc4.plain

Targets

    • Target

      5e05c4e375a9d930b9b6cb5d1a00d4e032ef1fae7573dbd4bb4a798b351e3b02

    • Size

      196KB

    • MD5

      f033bcd9080caa7841c8949f1cae59c1

    • SHA1

      e521741442ec2513203a1f1744484d36ac0888f8

    • SHA256

      5e05c4e375a9d930b9b6cb5d1a00d4e032ef1fae7573dbd4bb4a798b351e3b02

    • SHA512

      ccc3e0ac1ea2097030d9d70de8719391e4ebfd9e8902898a41a12f0cbf2a1c35f55204c6ca5b521ae2615644d6abfc4e50bc282241c4afff4870383f9fc790e9

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks