General

  • Target

    0473b71b73a952c51cf5e92f4c2133995b35c3512a5812312698cb2654e6095d

  • Size

    160KB

  • Sample

    210422-hbpdh9jjgj

  • MD5

    6add7324f05f338f960ca4d0e995a51a

  • SHA1

    da039fae969d9ae5e7dbed68bf6f38cad59f6f86

  • SHA256

    0473b71b73a952c51cf5e92f4c2133995b35c3512a5812312698cb2654e6095d

  • SHA512

    2d06be612b82642f0d369709b4e23d664a55963f344067711083a7ad6aea99cdf96e5c982cab8802348cc8faa3b05aa3f936d6d963663815bb23081d78383623

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      0473b71b73a952c51cf5e92f4c2133995b35c3512a5812312698cb2654e6095d

    • Size

      160KB

    • MD5

      6add7324f05f338f960ca4d0e995a51a

    • SHA1

      da039fae969d9ae5e7dbed68bf6f38cad59f6f86

    • SHA256

      0473b71b73a952c51cf5e92f4c2133995b35c3512a5812312698cb2654e6095d

    • SHA512

      2d06be612b82642f0d369709b4e23d664a55963f344067711083a7ad6aea99cdf96e5c982cab8802348cc8faa3b05aa3f936d6d963663815bb23081d78383623

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks