General

  • Target

    8cf3c898b1a174929010721ab4a567c3cdbbccfc6d62ebdc53a376fd4c3c5936

  • Size

    158KB

  • Sample

    210619-cvpn6rb2tx

  • MD5

    007285ea92c09f63010c5a6bf3588ff6

  • SHA1

    58ad5f29857f0da03ba9a23e1bcd45c68a9694e9

  • SHA256

    8cf3c898b1a174929010721ab4a567c3cdbbccfc6d62ebdc53a376fd4c3c5936

  • SHA512

    3c15e2c42362860d34050b4653587f7a94b5f4cf15270d2ce1eaf20453215fbdb7c87ab902a8d7d4f3000203c9b7fc2f7735768c9366aac5fef4d6fca49dff5a

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

8.210.53.215:443

72.249.22.245:2303

188.40.137.206:8172

rc4.plain
rc4.plain

Targets

    • Target

      8cf3c898b1a174929010721ab4a567c3cdbbccfc6d62ebdc53a376fd4c3c5936

    • Size

      158KB

    • MD5

      007285ea92c09f63010c5a6bf3588ff6

    • SHA1

      58ad5f29857f0da03ba9a23e1bcd45c68a9694e9

    • SHA256

      8cf3c898b1a174929010721ab4a567c3cdbbccfc6d62ebdc53a376fd4c3c5936

    • SHA512

      3c15e2c42362860d34050b4653587f7a94b5f4cf15270d2ce1eaf20453215fbdb7c87ab902a8d7d4f3000203c9b7fc2f7735768c9366aac5fef4d6fca49dff5a

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks