General

  • Target

    5d5a0272b665d7861ebeb81cde42361920705496e3eb2858088d41bfeaea66d9

  • Size

    160KB

  • Sample

    210618-22z7ndat2n

  • MD5

    96c325d15f14b4fa5b41cbae983bdba4

  • SHA1

    46c53017aa2749e8918223a4cdb3a3ec053794b7

  • SHA256

    5d5a0272b665d7861ebeb81cde42361920705496e3eb2858088d41bfeaea66d9

  • SHA512

    fe13fe24f597086b1cf9d54eae7cecf0ec384844749906c76a62117bfcefd7d7908b5d23f82c3282b18e779bb4a13bd785814d54e44be14648da5da596cd3398

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      5d5a0272b665d7861ebeb81cde42361920705496e3eb2858088d41bfeaea66d9

    • Size

      160KB

    • MD5

      96c325d15f14b4fa5b41cbae983bdba4

    • SHA1

      46c53017aa2749e8918223a4cdb3a3ec053794b7

    • SHA256

      5d5a0272b665d7861ebeb81cde42361920705496e3eb2858088d41bfeaea66d9

    • SHA512

      fe13fe24f597086b1cf9d54eae7cecf0ec384844749906c76a62117bfcefd7d7908b5d23f82c3282b18e779bb4a13bd785814d54e44be14648da5da596cd3398

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks