General

  • Target

    86dace727cc6ac317e4f4895a2c61270e4e7413e3056a26b305a710d2cde0424

  • Size

    160KB

  • Sample

    210620-69ws1nlrla

  • MD5

    48dce7362a8acb5bd7e9a5022212277c

  • SHA1

    847bdf7b9d7b2b3db5ba4b9ea5e1e6ae4b9ad0be

  • SHA256

    86dace727cc6ac317e4f4895a2c61270e4e7413e3056a26b305a710d2cde0424

  • SHA512

    5467711501a8630bbb47782469c45d3470f6f572bda9692277eaed8aeb9a1776faf1c1d4fabb1ec235d0bf80ff6174955554067c24e72b0a74a222b2bd19d267

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      86dace727cc6ac317e4f4895a2c61270e4e7413e3056a26b305a710d2cde0424

    • Size

      160KB

    • MD5

      48dce7362a8acb5bd7e9a5022212277c

    • SHA1

      847bdf7b9d7b2b3db5ba4b9ea5e1e6ae4b9ad0be

    • SHA256

      86dace727cc6ac317e4f4895a2c61270e4e7413e3056a26b305a710d2cde0424

    • SHA512

      5467711501a8630bbb47782469c45d3470f6f572bda9692277eaed8aeb9a1776faf1c1d4fabb1ec235d0bf80ff6174955554067c24e72b0a74a222b2bd19d267

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks