General

  • Target

    f4d14bfd42914a97199dee53179aa36b4a37b8a917844d87e1ef3049b2ff4e79

  • Size

    160KB

  • Sample

    210620-8kzynwq7fn

  • MD5

    0add268bece6d3529e31fe0f8950461e

  • SHA1

    634c75b7a8bf88dc994f2ebe130db0e82f3ecbfb

  • SHA256

    f4d14bfd42914a97199dee53179aa36b4a37b8a917844d87e1ef3049b2ff4e79

  • SHA512

    51dd7c37a04f2e9d6eae399a3a33987a97da064330e47a471dd84a557ce38f358677a07dafaaae2ceaefaf77d7a176d636ee1d32cdf4386709e6e24c628e5563

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      f4d14bfd42914a97199dee53179aa36b4a37b8a917844d87e1ef3049b2ff4e79

    • Size

      160KB

    • MD5

      0add268bece6d3529e31fe0f8950461e

    • SHA1

      634c75b7a8bf88dc994f2ebe130db0e82f3ecbfb

    • SHA256

      f4d14bfd42914a97199dee53179aa36b4a37b8a917844d87e1ef3049b2ff4e79

    • SHA512

      51dd7c37a04f2e9d6eae399a3a33987a97da064330e47a471dd84a557ce38f358677a07dafaaae2ceaefaf77d7a176d636ee1d32cdf4386709e6e24c628e5563

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks