General

  • Target

    ca5a5d7528b1327c8e6cc207ff867802612a7369163b66b4946baa149611595e

  • Size

    160KB

  • Sample

    210619-abeyflf8ds

  • MD5

    1b98c8faa0eb5bce71e6105d2cf36752

  • SHA1

    7d3081679304c7cc13711848be8ad111b68fd8fd

  • SHA256

    ca5a5d7528b1327c8e6cc207ff867802612a7369163b66b4946baa149611595e

  • SHA512

    a6d90600e2b8c3d5b1e9b58133d24f07de2221fba09708162392630fdb0432025575761236b9f73c63c2a1f6f4844600f5637452eef23d63c7472fc7fcd3f03b

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      ca5a5d7528b1327c8e6cc207ff867802612a7369163b66b4946baa149611595e

    • Size

      160KB

    • MD5

      1b98c8faa0eb5bce71e6105d2cf36752

    • SHA1

      7d3081679304c7cc13711848be8ad111b68fd8fd

    • SHA256

      ca5a5d7528b1327c8e6cc207ff867802612a7369163b66b4946baa149611595e

    • SHA512

      a6d90600e2b8c3d5b1e9b58133d24f07de2221fba09708162392630fdb0432025575761236b9f73c63c2a1f6f4844600f5637452eef23d63c7472fc7fcd3f03b

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks