General

  • Target

    0a22fb9d5d803925906cd77c165d8f75d7ba96604ed3daf805c37efdb38e5cba

  • Size

    162KB

  • Sample

    210421-1d8z3p1jje

  • MD5

    7dfe6ead3198feab4a05ba1d93c3abe0

  • SHA1

    317849bb2eb4d4ef1a4f69e65d11e8add7c5ef76

  • SHA256

    0a22fb9d5d803925906cd77c165d8f75d7ba96604ed3daf805c37efdb38e5cba

  • SHA512

    b9239a99363327a5dc0d6caa49ae1846132e63b0fe514e9c2812d3b8cf5e768ec11e8bf22276787f5e8a2f92a7b1f6c05737bad0fa736128485c9d8bcb9fc395

Malware Config

Extracted

Family

dridex

Botnet

40112

C2

107.172.227.10:443

172.93.133.123:2303

108.168.61.147:8172

rc4.plain
rc4.plain

Targets

    • Target

      0a22fb9d5d803925906cd77c165d8f75d7ba96604ed3daf805c37efdb38e5cba

    • Size

      162KB

    • MD5

      7dfe6ead3198feab4a05ba1d93c3abe0

    • SHA1

      317849bb2eb4d4ef1a4f69e65d11e8add7c5ef76

    • SHA256

      0a22fb9d5d803925906cd77c165d8f75d7ba96604ed3daf805c37efdb38e5cba

    • SHA512

      b9239a99363327a5dc0d6caa49ae1846132e63b0fe514e9c2812d3b8cf5e768ec11e8bf22276787f5e8a2f92a7b1f6c05737bad0fa736128485c9d8bcb9fc395

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks