General

  • Target

    d00573672cb59b5e330fef81f2dc45712aec5056ac9133e2c102b20eb30d76a2

  • Size

    160KB

  • Sample

    210618-j5hdelzd6n

  • MD5

    31216eb6c56afd08215a42ebb9213da6

  • SHA1

    82848ddbb252b802b8f3988986b2f44932315b67

  • SHA256

    d00573672cb59b5e330fef81f2dc45712aec5056ac9133e2c102b20eb30d76a2

  • SHA512

    88b4a781ce0bac98576404b988e9f3a28e7864a49811fd7f9e4e0cd9249f29eacc0c56eaffd34cd486f397d0eb2aee0b7f5e6d3966cfadcc37860fa188133553

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      d00573672cb59b5e330fef81f2dc45712aec5056ac9133e2c102b20eb30d76a2

    • Size

      160KB

    • MD5

      31216eb6c56afd08215a42ebb9213da6

    • SHA1

      82848ddbb252b802b8f3988986b2f44932315b67

    • SHA256

      d00573672cb59b5e330fef81f2dc45712aec5056ac9133e2c102b20eb30d76a2

    • SHA512

      88b4a781ce0bac98576404b988e9f3a28e7864a49811fd7f9e4e0cd9249f29eacc0c56eaffd34cd486f397d0eb2aee0b7f5e6d3966cfadcc37860fa188133553

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks