General

  • Target

    89d98d59f5fc514bf90aa465dedc58d1117a0f24b1095b5896f22e8ae86b5a3c

  • Size

    161KB

  • Sample

    210421-ah2yjy5yme

  • MD5

    bd4d502332d1c6cd8b7dcb72760d2ede

  • SHA1

    a5ab6f2baaaaa0be038c5409bbb3418d648944b5

  • SHA256

    89d98d59f5fc514bf90aa465dedc58d1117a0f24b1095b5896f22e8ae86b5a3c

  • SHA512

    2502afdd8f161d784f24b6c96a10b2549dd83b4cb907584bdfffd559ad259fb4ba288ada194c638d18389f82c00cb131898e4adc94185108504caabaad49f2f5

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

107.172.227.10:443

172.93.133.123:2303

108.168.61.147:8172

rc4.plain
rc4.plain

Targets

    • Target

      89d98d59f5fc514bf90aa465dedc58d1117a0f24b1095b5896f22e8ae86b5a3c

    • Size

      161KB

    • MD5

      bd4d502332d1c6cd8b7dcb72760d2ede

    • SHA1

      a5ab6f2baaaaa0be038c5409bbb3418d648944b5

    • SHA256

      89d98d59f5fc514bf90aa465dedc58d1117a0f24b1095b5896f22e8ae86b5a3c

    • SHA512

      2502afdd8f161d784f24b6c96a10b2549dd83b4cb907584bdfffd559ad259fb4ba288ada194c638d18389f82c00cb131898e4adc94185108504caabaad49f2f5

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks