Overview

overview

10

Static

static

3df393d5e4...cd.dll

windows7_x64

10

3df393d5e4...cd.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3df393d5e44c247d97110d61fe65dfc17eb522f81339edc0d9dbf15d0f144ccd

  • Size

    196KB

  • Sample

    210304-qszt8fss1a

  • MD5

    221ab16536a63db4cdcd19f78ec0b8b9

  • SHA1

    ac300209c6e0ea97d048436ea4d94199d5023fd4

  • SHA256

    3df393d5e44c247d97110d61fe65dfc17eb522f81339edc0d9dbf15d0f144ccd

  • SHA512

    f19617098d145713c73e5ab25c81330d3d2166a0cabd4643babd52c12f8639e07e87fae95a75b2989f62860846287fb83a823d36aa5eac55055d3693590fb0c0

Score
10/10
dridex111botnetdiscoveryevasionloadertrojan

Malware Config

Extracted

Family

dridex

Botnet

111

C2

37.247.35.132:443

50.243.30.51:6601

162.241.204.234:6516
rc4.plain
rc4.plain

Targets

    • Target

      3df393d5e44c247d97110d61fe65dfc17eb522f81339edc0d9dbf15d0f144ccd

    • Size

      196KB

    • MD5

      221ab16536a63db4cdcd19f78ec0b8b9

    • SHA1

      ac300209c6e0ea97d048436ea4d94199d5023fd4

    • SHA256

      3df393d5e44c247d97110d61fe65dfc17eb522f81339edc0d9dbf15d0f144ccd

    • SHA512

      f19617098d145713c73e5ab25c81330d3d2166a0cabd4643babd52c12f8639e07e87fae95a75b2989f62860846287fb83a823d36aa5eac55055d3693590fb0c0

    Score
    10/10
    dridex111botnetdiscoveryevasionloadertrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

      botnetloader

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks