General

  • Target

    b51cef58a04323f4848f7c78158d8f54b6c585519fcd5c31411573e4e6cb00d3

  • Size

    161KB

  • Sample

    210421-zjazj3zewa

  • MD5

    74f4904fc44423e091f75de4dc86ddcb

  • SHA1

    88691e08c904de4369cd7140b2e8303564ca5467

  • SHA256

    b51cef58a04323f4848f7c78158d8f54b6c585519fcd5c31411573e4e6cb00d3

  • SHA512

    e15609fe156b028b31defa7e1b8ce41869de98c72a2b30887c5b560d0431194cbc6072336930661d0610f6e1e6527ec0b097b2890cd86bfda9adbc48aa7bd850

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

107.172.227.10:443

172.93.133.123:2303

108.168.61.147:8172

rc4.plain
rc4.plain

Targets

    • Target

      b51cef58a04323f4848f7c78158d8f54b6c585519fcd5c31411573e4e6cb00d3

    • Size

      161KB

    • MD5

      74f4904fc44423e091f75de4dc86ddcb

    • SHA1

      88691e08c904de4369cd7140b2e8303564ca5467

    • SHA256

      b51cef58a04323f4848f7c78158d8f54b6c585519fcd5c31411573e4e6cb00d3

    • SHA512

      e15609fe156b028b31defa7e1b8ce41869de98c72a2b30887c5b560d0431194cbc6072336930661d0610f6e1e6527ec0b097b2890cd86bfda9adbc48aa7bd850

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks