Overview

overview

10

Static

static

fbd5e02e_b...is.dll

windows7_x64

10

fbd5e02e_b...is.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fbd5e02e_by_Libranalysis

  • Size

    162KB

  • Sample

    210511-k42y6sg2ce

  • MD5

    fbd5e02e3bc0bacb0fd26384b348719b

  • SHA1

    afa325ea0ab63f2265c14ed4cd6834dbcf30208f

  • SHA256

    37b3dea4c6f9972e89e7816255802419a7d4c5752a2f1f3501a0c61d07f80736

  • SHA512

    99cb0dd0108dbe03cb47077c11b96f8e6040a8117f7c1878093d548e12b0c8a30739ad74c005d69b12570178cd384f453f0d0364269869f613fb22c2d5fd6974

Score
10/10
dridex40112botnetevasionloadertrojan

Malware Config

Extracted

Family

dridex

Botnet

40112

C2

107.172.227.10:443

172.93.133.123:2303

108.168.61.147:8172
rc4.plain
rc4.plain

Targets

    • Target

      fbd5e02e_by_Libranalysis

    • Size

      162KB

    • MD5

      fbd5e02e3bc0bacb0fd26384b348719b

    • SHA1

      afa325ea0ab63f2265c14ed4cd6834dbcf30208f

    • SHA256

      37b3dea4c6f9972e89e7816255802419a7d4c5752a2f1f3501a0c61d07f80736

    • SHA512

      99cb0dd0108dbe03cb47077c11b96f8e6040a8117f7c1878093d548e12b0c8a30739ad74c005d69b12570178cd384f453f0d0364269869f613fb22c2d5fd6974

    Score
    10/10
    dridex40112botnetevasionloadertrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

      botnetloader

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks