b4f4e82ed5bd7d5b27af2ab1dd2a71f90c97012c53117841da6300f9e2882f85

General
Target

b4f4e82ed5bd7d5b27af2ab1dd2a71f90c97012c53117841da6300f9e2882f85

Size

170KB

Sample

210611-jnq3g957ba

Score
10 /10
MD5

060351ef5abb400fb9e916b5d91ceddc

SHA1

b3605c9cb634065fb137c02d03cb129248b09618

SHA256

b4f4e82ed5bd7d5b27af2ab1dd2a71f90c97012c53117841da6300f9e2882f85

SHA512

762d75b480e5dccf6aae19e69d6d9f51159234a9f790343fb8c6597ea03ae88e4be092f41747d3f8b9e185b1fcb24984b763a65e66db31adafd3b1a143987bf3

Malware Config

Extracted

Family dridex
Botnet 22201
C2

210.65.244.187:443

162.241.41.92:2303

46.231.204.10:8172

185.183.159.100:4125

rc4.plain
rc4.plain
Targets
Target

b4f4e82ed5bd7d5b27af2ab1dd2a71f90c97012c53117841da6300f9e2882f85

MD5

060351ef5abb400fb9e916b5d91ceddc

Filesize

170KB

Score
10 /10
SHA1

b3605c9cb634065fb137c02d03cb129248b09618

SHA256

b4f4e82ed5bd7d5b27af2ab1dd2a71f90c97012c53117841da6300f9e2882f85

SHA512

762d75b480e5dccf6aae19e69d6d9f51159234a9f790343fb8c6597ea03ae88e4be092f41747d3f8b9e185b1fcb24984b763a65e66db31adafd3b1a143987bf3

Tags

Signatures

  • Dridex

    Description

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    Tags

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Dridex Loader

    Description

    Detects Dridex both x86 and x64 loader in memory.

    Tags

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Tasks

                          static1

                          behavioral1

                          10/10