Overview

overview

10

Static

static

f5244f6dd2...90.dll

windows7_x64

10

f5244f6dd2...90.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f5244f6dd238f874d7f9bacd7d94e1e004e1a14249e789c6613eca5e245a3d90

  • Size

    162KB

  • Sample

    210421-yvrvcyc8ha

  • MD5

    72e631c2930bf8ae585b85f1ea16e2ba

  • SHA1

    54af46cf0613396acce3aab43d30f97526f44700

  • SHA256

    f5244f6dd238f874d7f9bacd7d94e1e004e1a14249e789c6613eca5e245a3d90

  • SHA512

    37e137a8fa22a9bf8ad8a426596c39f3156d653fba7437bb7b0f7b80621eff59d845c973a393e32d24ced0fef76a55159d84dbd58e95f1c7b78f6b1f8a03f4b3

Score
10/10
dridex40112botnetevasionloadertrojan

Malware Config

Extracted

Family

dridex

Botnet

40112

C2

107.172.227.10:443

172.93.133.123:2303

108.168.61.147:8172
rc4.plain
rc4.plain

Targets

    • Target

      f5244f6dd238f874d7f9bacd7d94e1e004e1a14249e789c6613eca5e245a3d90

    • Size

      162KB

    • MD5

      72e631c2930bf8ae585b85f1ea16e2ba

    • SHA1

      54af46cf0613396acce3aab43d30f97526f44700

    • SHA256

      f5244f6dd238f874d7f9bacd7d94e1e004e1a14249e789c6613eca5e245a3d90

    • SHA512

      37e137a8fa22a9bf8ad8a426596c39f3156d653fba7437bb7b0f7b80621eff59d845c973a393e32d24ced0fef76a55159d84dbd58e95f1c7b78f6b1f8a03f4b3

    Score
    10/10
    dridex40112botnetevasionloadertrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

      botnetloader

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks