Overview

overview

10

Static

static

Document#5...39.vbs

windows7_x64

10

Document#5...39.vbs

windows10_x64

10

Resubmissions

19-03-2021 09:03

210319-zqkthetyla 10

12-05-2020 06:47

200512-23g7l1gtz2 7

11-05-2020 10:40

200511-v8w3g6hxyj 7

08-05-2020 08:13

200508-ggjrjfejyj 8

06-05-2020 16:56

200506-sj25e3d79e 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Document#578743906539.zip

  • Size

    344KB

  • Sample

    210319-zqkthetyla

  • MD5

    1c0842a902658d5522509e669277c419

  • SHA1

    4e4853387b6ab7119bbaa469e0ea7e21026fd0b1

  • SHA256

    935dd5f6759b2409a7140432b11595b7585b985836a14637aa3bd208f4f82b32

  • SHA512

    e09759706948214ffa03830ce2cdf527531200022027607746037b2cda547e6273af6be662265392c3717878e0d547f8bd67cf1e181221f34b9f801b24bb5477

Score
10/10
dridex10555botnetloader

Malware Config

Extracted

Family

dridex

Botnet

10555

C2

38.88.126.131:443

145.239.169.32:8443

163.172.7.152:443

45.79.135.98:691
rc4.plain
rc4.plain

Targets

    • Target

      Document#578743906539.vbs

    • Size

      980KB

    • MD5

      27588243419b10040ea332eed512e18a

    • SHA1

      c26304277f80fdf95db29aa700a01d650c5f2ed3

    • SHA256

      76d804d87108c6997469997da29236b271519362fe9f7e518a25a102835a7e06

    • SHA512

      3f947d749bc42851cc79e81ca568e5e2ea996c5fc30c24958584f80305fdb72eae5f1f050a347d08758b79f6a9717439bc75c69e64ed198609c713dd1f392412

    Score
    10/10
    dridex10555botnetloader

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

      botnetloader

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks