General

  • Target

    e76ca28fa0c2e5840d3f802c3002644021466c3714112cd716ef1e1ca679b9a2

  • Size

    160KB

  • Sample

    210620-1hmghvyp7j

  • MD5

    f4237c9be34a23a3e193988ea13b79c2

  • SHA1

    abcc37f59367d5a74e0012ad497739bb0fe84ea3

  • SHA256

    e76ca28fa0c2e5840d3f802c3002644021466c3714112cd716ef1e1ca679b9a2

  • SHA512

    f77cc7d2e63c03ba9aa04326067f3a2ddfdee50ef79f13f6bc8f0b4f7fced411eda40da56bf464ed6a2776d22f40b0d0638a91e5d05118edf017de3a8159298d

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      e76ca28fa0c2e5840d3f802c3002644021466c3714112cd716ef1e1ca679b9a2

    • Size

      160KB

    • MD5

      f4237c9be34a23a3e193988ea13b79c2

    • SHA1

      abcc37f59367d5a74e0012ad497739bb0fe84ea3

    • SHA256

      e76ca28fa0c2e5840d3f802c3002644021466c3714112cd716ef1e1ca679b9a2

    • SHA512

      f77cc7d2e63c03ba9aa04326067f3a2ddfdee50ef79f13f6bc8f0b4f7fced411eda40da56bf464ed6a2776d22f40b0d0638a91e5d05118edf017de3a8159298d

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks