Overview

overview

10

Static

static

9f7a9948_b...is.dll

windows7_x64

10

9f7a9948_b...is.dll

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    9f7a9948_by_Libranalysis
  • Size 162KB
  • Sample210512-5cb8apm4fs
  • SHA256 eba1640261ccfb94b564c263a1909ef49b1c18c503df4dc99905587bb25d94f5
  • MD5 SHA1 SHA512
Score
10/10
dridex40112botnetevasionloaderransomwaretrojan

Malware Config

Extracted

Family

  • dridex

Botnet

  • 40112

C2

  • 107.172.227.10:443

  • 172.93.133.123:2303

  • 108.168.61.147:8172

rc4.plain
rc4.plain

Extracted

Path

  • C:\Windows\TEMP\RESTORE_FILES_INFO.txt

Ransom Note
  • YOUR COMPANY NETWORK HAS BEEN HACKED All your important files have been encrypted! Your files are safe! Only modified.(AES) No software available on internet can help you. We are the only ones able to decrypt your files. -------------------------------------------------------------------------------- We also gathered highly confidential/personal data. These data are currently stored on a private server. Files are also encrypted and stored securely. -------------------------------------------------------------------------------- As a result of working with us, you will receive: Fully automatic decryptor, all your data will be recovered within a few hours after it's run. Server with your data will be immediately destroyed after your payment. Save time and continue working. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. -------------------------------------------------------------------------------- !!!!!!!!!!!!!!!!!!!!!!!! If you decide not to work with us: All data on your computers will remain encrypted forever. YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER! So you can expect your data to be publicly available in the near future.. The price will increase over time. !!!!!!!!!!!!!!!!!!!!!!!!! -------------------------------------------------------------------------------- It doesn't matter to us what you choose pay us or we will sell your data. We only seek money and our goal is not to damage your reputation or prevent your business from running. Write to us now and we will provide the best prices. Instructions for contacting us: ____________________________________________________________________________________ You have two ways: 1) [Recommended] Using a TOR browser! a. Download and install TOR browser from this site: https://torproject.org/ b. Open the Tor browser. Copy the link: http://promethw27cbrcot.onion/ticket.php?track=141-5D9-Y454 and paste it in the Tor browser. c. Start a chat and follow the further instructions. 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a. Open your any browser (Chrome, Firefox, Opera, IE, Edge) b. Open our secondary website: http://prometheusdec.in/ticket.php?track=141-5D9-Y454 c. Start a chat and follow the further instructions. Warning: secondary website can be blocked, thats why first variant much better and more available. _____________________________________________________________________________________ Attention! Any attempt to restore your files with third-party software will corrupt it. Modify or rename files will result in a loose of data. If you decide to try anyway, make copies before that Key Identifier: k8e1tgfjDeKLRXe7wz5HLzYppA5mcPxMlqavW9GMQWd9XbomzncA/GBEk+mG33W42aU7d/yb2x9AYHsHzpT6ct1RI1XTOcp+2C1ks8H1K4VNjszjX3mE6vD/HeFza29eCXkQ6k7ptJY+ZnjeK2+AZ9RHVZ6nYLNjQtHDEt2Rx0WYYK9fgNPDuQ5jQ9bBWfrwN0m9BbGBQ+3D+tB3PZ62k518/lxJALWzR2u8Vs0A9DHV7VBYyGMkdnK6pVZmz6Ufc5zoXgB+qEmebhfb0+gIKqoyE3pAfRw7yMgzQLByaZCDHp0DDpoVnp7HjS0fu2wldAsqqVoGRQyEur+4MWQ7Y4TGKVSTd3CZUYQiO/gZPva0OJgE0kJAClUgGINfsuwno46KlW0+O1g9nmKtvCrsC28+3JOGM5qSLQ2SxqMYIC+EgX4j7hp/CLpfjtDSWEGthhgSdrsyQPWfb05BrD94w65cXJ6EtJ3iDOW3sliL/0ds5l2abvjX9bAT+7KLKPGWRmBdw4wkY92UzDcqpJ4HHovV2//Lq+szd5yDuiLxTG9fnrGSJELYxAFIgg0GMpcEa4OMD6+GvI3hQazRwCI6ppbbumwxT1YJnnKS+E5xMwESsTvUxT6QdPPkvppU81Z5X0yFiDyyhe3CXR53YP4eCADOrFR7TDQN3PDoDXeX9As=
URLs

  • http://promethw27cbrcot.onion/ticket.php?track=141-5D9-Y454

  • http://prometheusdec.in/ticket.php?track=141-5D9-Y454

Targets

    • Target
      9f7a9948_by_Libranalysis
    • Size 162KB
    • SHA256 eba1640261ccfb94b564c263a1909ef49b1c18c503df4dc99905587bb25d94f5
    • MD5 SHA1 SHA512
    Score
    10/10
    dridex40112botnetevasionloadertrojanransomware

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

      botnetloader

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks