Overview

overview

10

Static

static

5a9225e5_b...is.dll

windows7_x64

10

5a9225e5_b...is.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5a9225e5_by_Libranalysis

  • Size

    162KB

  • Sample

    210511-ht2saad9ja

  • MD5

    5a9225e5dd050879718312863e486631

  • SHA1

    8c5010542c214c69ef40e18f156ce924911d54b1

  • SHA256

    b59e0ca13e74a09ff3d6c8096bb022ac9e21e9c3baa8193ff2db3ff31af3650d

  • SHA512

    cada697dfa424a98a96d4019643b9c4437069aa33d9e831c949d4f7d0d1b09fafbe321182892fb07c8397654e107e05046177b04b4a879721185b0ab736ba374

Score
10/10
dridex40112botnetevasionloadertrojan

Malware Config

Extracted

Family

dridex

Botnet

40112

C2

107.172.227.10:443

172.93.133.123:2303

108.168.61.147:8172
rc4.plain
rc4.plain

Targets

    • Target

      5a9225e5_by_Libranalysis

    • Size

      162KB

    • MD5

      5a9225e5dd050879718312863e486631

    • SHA1

      8c5010542c214c69ef40e18f156ce924911d54b1

    • SHA256

      b59e0ca13e74a09ff3d6c8096bb022ac9e21e9c3baa8193ff2db3ff31af3650d

    • SHA512

      cada697dfa424a98a96d4019643b9c4437069aa33d9e831c949d4f7d0d1b09fafbe321182892fb07c8397654e107e05046177b04b4a879721185b0ab736ba374

    Score
    10/10
    dridex40112botnetevasionloadertrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

      botnetloader

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks