General

  • Target

    55c3a511b341a2e9e29738f6661a99972c3abe72bc9e1f356e61db63280366c0

  • Size

    162KB

  • Sample

    210421-tlnnjqzx92

  • MD5

    4e67e4c439fecb306d42d6830e57b4e7

  • SHA1

    c923008ff258c0c5487aac074260ca05e9d30c80

  • SHA256

    55c3a511b341a2e9e29738f6661a99972c3abe72bc9e1f356e61db63280366c0

  • SHA512

    2681be4ae5d39e9552e58a3c8d34c0a99921a86eb4ed4386a1ea6b250bef4cd1f79a553c6537e57373bf78d06ff71321bf8aac999565631a3df2726deda722c1

Malware Config

Extracted

Family

dridex

Botnet

40112

C2

107.172.227.10:443

172.93.133.123:2303

108.168.61.147:8172

rc4.plain
rc4.plain

Targets

    • Target

      55c3a511b341a2e9e29738f6661a99972c3abe72bc9e1f356e61db63280366c0

    • Size

      162KB

    • MD5

      4e67e4c439fecb306d42d6830e57b4e7

    • SHA1

      c923008ff258c0c5487aac074260ca05e9d30c80

    • SHA256

      55c3a511b341a2e9e29738f6661a99972c3abe72bc9e1f356e61db63280366c0

    • SHA512

      2681be4ae5d39e9552e58a3c8d34c0a99921a86eb4ed4386a1ea6b250bef4cd1f79a553c6537e57373bf78d06ff71321bf8aac999565631a3df2726deda722c1

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks