General

  • Target

    1480e6001c4d8c841b855f7c806d186b9b6d2bc541b442bedbc14cd200a58614

  • Size

    158KB

  • Sample

    210615-gvtlvsgjfn

  • MD5

    4de5ec4718c936afdca4ed97f00d05e8

  • SHA1

    fad3d9167eabc0132aa6afaf2acbbc78b3ab8786

  • SHA256

    1480e6001c4d8c841b855f7c806d186b9b6d2bc541b442bedbc14cd200a58614

  • SHA512

    e6e8c1252bb86e2df0c01ab4335c2ca72683191cb0a121a75188bbe15127c8f4bf45eee149fdd6cdf4ef07e392ba65e7719ea179b09576c267e3aa7d206df5d9

Malware Config

Extracted

Family

dridex

Botnet

40112

C2

8.210.53.215:443

72.249.22.245:2303

188.40.137.206:8172

rc4.plain
rc4.plain

Targets

    • Target

      1480e6001c4d8c841b855f7c806d186b9b6d2bc541b442bedbc14cd200a58614

    • Size

      158KB

    • MD5

      4de5ec4718c936afdca4ed97f00d05e8

    • SHA1

      fad3d9167eabc0132aa6afaf2acbbc78b3ab8786

    • SHA256

      1480e6001c4d8c841b855f7c806d186b9b6d2bc541b442bedbc14cd200a58614

    • SHA512

      e6e8c1252bb86e2df0c01ab4335c2ca72683191cb0a121a75188bbe15127c8f4bf45eee149fdd6cdf4ef07e392ba65e7719ea179b09576c267e3aa7d206df5d9

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks