General

  • Target

    1d7feb8a1c20d9b7448b659b847a70e41f315c411246550f2cfede879e588de8

  • Size

    160KB

  • Sample

    210618-r3n8h752hx

  • MD5

    2790559e3a5441c8096da611fb3af600

  • SHA1

    c5ba509b59060fba3c1dceffed9818b8b2f23f58

  • SHA256

    1d7feb8a1c20d9b7448b659b847a70e41f315c411246550f2cfede879e588de8

  • SHA512

    01fa80eee3ee60af22b37ab24e9a99546aa57334cc9885b2ba00914da3f487b3654cbc96bedc62f031b5a2b7e642c030fff7fcfc937de2abdaaa18b3c9afe573

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      1d7feb8a1c20d9b7448b659b847a70e41f315c411246550f2cfede879e588de8

    • Size

      160KB

    • MD5

      2790559e3a5441c8096da611fb3af600

    • SHA1

      c5ba509b59060fba3c1dceffed9818b8b2f23f58

    • SHA256

      1d7feb8a1c20d9b7448b659b847a70e41f315c411246550f2cfede879e588de8

    • SHA512

      01fa80eee3ee60af22b37ab24e9a99546aa57334cc9885b2ba00914da3f487b3654cbc96bedc62f031b5a2b7e642c030fff7fcfc937de2abdaaa18b3c9afe573

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks