General

  • Target

    0045afba83e04e3333cfce3bc298bf249aaf1bab4b7f7fda3c0c15947ed21986

  • Size

    158KB

  • Sample

    210618-qzhbmdjmej

  • MD5

    75c226f0c4eb4b0f6c6901c62e73fd9b

  • SHA1

    af67c822c34e52fdc6b51a03aedcf5202a87d098

  • SHA256

    0045afba83e04e3333cfce3bc298bf249aaf1bab4b7f7fda3c0c15947ed21986

  • SHA512

    e6eaf43b71b74fc5dc85e6fa7e9916d1fe57d56c3e237fdd5b8e93eafe2314c8a8f88865fe6da666a0f82fb576c7776348760388cc0e45050eee463d3aed3759

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

8.210.53.215:443

72.249.22.245:2303

188.40.137.206:8172

rc4.plain
rc4.plain

Targets

    • Target

      0045afba83e04e3333cfce3bc298bf249aaf1bab4b7f7fda3c0c15947ed21986

    • Size

      158KB

    • MD5

      75c226f0c4eb4b0f6c6901c62e73fd9b

    • SHA1

      af67c822c34e52fdc6b51a03aedcf5202a87d098

    • SHA256

      0045afba83e04e3333cfce3bc298bf249aaf1bab4b7f7fda3c0c15947ed21986

    • SHA512

      e6eaf43b71b74fc5dc85e6fa7e9916d1fe57d56c3e237fdd5b8e93eafe2314c8a8f88865fe6da666a0f82fb576c7776348760388cc0e45050eee463d3aed3759

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks