General

  • Target

    f4fb96704c00e244912efb7a09b3f68dc5c6bc514919139e0b2b423fd4c608f6

  • Size

    160KB

  • Sample

    210619-j2g8zndb86

  • MD5

    ecef1e23354a4d4027281615dc817669

  • SHA1

    870c5019895d346492b32fd87cbc3f14a95a2c00

  • SHA256

    f4fb96704c00e244912efb7a09b3f68dc5c6bc514919139e0b2b423fd4c608f6

  • SHA512

    b2f47281c7786a822eed7b6c3c746ccee73005bd0d12de8a847ed0d4c5325f08c572a48a6e6c31b6c46a30b72d7453fbf91f8c9864fe8458b77b9024fcac9a52

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      f4fb96704c00e244912efb7a09b3f68dc5c6bc514919139e0b2b423fd4c608f6

    • Size

      160KB

    • MD5

      ecef1e23354a4d4027281615dc817669

    • SHA1

      870c5019895d346492b32fd87cbc3f14a95a2c00

    • SHA256

      f4fb96704c00e244912efb7a09b3f68dc5c6bc514919139e0b2b423fd4c608f6

    • SHA512

      b2f47281c7786a822eed7b6c3c746ccee73005bd0d12de8a847ed0d4c5325f08c572a48a6e6c31b6c46a30b72d7453fbf91f8c9864fe8458b77b9024fcac9a52

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks