Overview

overview

10

Static

static

b1d20f9476...d0.dll

windows7_x64

10

b1d20f9476...d0.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b1d20f9476d18710fc5e2864d4a274f9b92d5e0ee49459b475054ec508d4a1d0

  • Size

    162KB

  • Sample

    210421-9zktqzhzl6

  • MD5

    0c278719773016f6bc6132ff4cd0372f

  • SHA1

    b1bf30adc535fac8c04bfbfcfbac83899da6e9d3

  • SHA256

    b1d20f9476d18710fc5e2864d4a274f9b92d5e0ee49459b475054ec508d4a1d0

  • SHA512

    8b924e64dc327e43bbe263ea7c3beea53a4d12b796c51bf8ddd70204bbeff1d3caff26bde191148926d0454093c3000ae36bd166d680467bf80fd0e7591c1850

Score
10/10
dridex40112botnetevasionloadertrojan

Malware Config

Extracted

Family

dridex

Botnet

40112

C2

107.172.227.10:443

172.93.133.123:2303

108.168.61.147:8172
rc4.plain
rc4.plain

Targets

    • Target

      b1d20f9476d18710fc5e2864d4a274f9b92d5e0ee49459b475054ec508d4a1d0

    • Size

      162KB

    • MD5

      0c278719773016f6bc6132ff4cd0372f

    • SHA1

      b1bf30adc535fac8c04bfbfcfbac83899da6e9d3

    • SHA256

      b1d20f9476d18710fc5e2864d4a274f9b92d5e0ee49459b475054ec508d4a1d0

    • SHA512

      8b924e64dc327e43bbe263ea7c3beea53a4d12b796c51bf8ddd70204bbeff1d3caff26bde191148926d0454093c3000ae36bd166d680467bf80fd0e7591c1850

    Score
    10/10
    dridex40112botnetevasionloadertrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

      botnetloader

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks