General

  • Target

    d3d1fa2df20702de1ef7b21a21f13e8d291ca8bc317a4c46c3c57c5a57a7b823

  • Size

    160KB

  • Sample

    210619-wz6tbqg3jn

  • MD5

    1ad28c39267e11f260413adfe795507f

  • SHA1

    938fae861ceeb534a725c04d38afdc8ba094ec8f

  • SHA256

    d3d1fa2df20702de1ef7b21a21f13e8d291ca8bc317a4c46c3c57c5a57a7b823

  • SHA512

    e36246d20dcf5c97dc0a59ab3d4f019203ff1117c3f51c8963dc2deb096c3ff11d916b30a02bc982b9e1498c5d471ccd7955c6a02b9279ae3dd88c114ea742ab

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      d3d1fa2df20702de1ef7b21a21f13e8d291ca8bc317a4c46c3c57c5a57a7b823

    • Size

      160KB

    • MD5

      1ad28c39267e11f260413adfe795507f

    • SHA1

      938fae861ceeb534a725c04d38afdc8ba094ec8f

    • SHA256

      d3d1fa2df20702de1ef7b21a21f13e8d291ca8bc317a4c46c3c57c5a57a7b823

    • SHA512

      e36246d20dcf5c97dc0a59ab3d4f019203ff1117c3f51c8963dc2deb096c3ff11d916b30a02bc982b9e1498c5d471ccd7955c6a02b9279ae3dd88c114ea742ab

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks