General

  • Target

    448c8df2fa4f49e7106abd7c82677cfe2fbad61e833c430024abf731efc7780a

  • Size

    160KB

  • Sample

    210619-kt9phqc4yn

  • MD5

    db9aa42530b9923f7aa30c7c2ccd1791

  • SHA1

    10182c464c2d6b49060e356c27305a0c37e653d5

  • SHA256

    448c8df2fa4f49e7106abd7c82677cfe2fbad61e833c430024abf731efc7780a

  • SHA512

    135bfa37596878204c13d511cf065b79a0a4dee0661cd6b10b4bc0bda24f73ebca4bd98893ebc571a2472e06848e0aba0bedea61e74e54a1c01b697b4016af3d

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      448c8df2fa4f49e7106abd7c82677cfe2fbad61e833c430024abf731efc7780a

    • Size

      160KB

    • MD5

      db9aa42530b9923f7aa30c7c2ccd1791

    • SHA1

      10182c464c2d6b49060e356c27305a0c37e653d5

    • SHA256

      448c8df2fa4f49e7106abd7c82677cfe2fbad61e833c430024abf731efc7780a

    • SHA512

      135bfa37596878204c13d511cf065b79a0a4dee0661cd6b10b4bc0bda24f73ebca4bd98893ebc571a2472e06848e0aba0bedea61e74e54a1c01b697b4016af3d

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks