General

  • Target

    c432efee7d9247f156890333906920c3fab1687b6b9aa0e7315b3b1062d3b3e3

  • Size

    160KB

  • Sample

    210620-tm5sqm3x5e

  • MD5

    82032e9c73796524a14275d79b8e8d03

  • SHA1

    47e4da8699a78102a4f49cdd028299baecd12771

  • SHA256

    c432efee7d9247f156890333906920c3fab1687b6b9aa0e7315b3b1062d3b3e3

  • SHA512

    87b5419533cf1fa34ec14974501f21f6279ca65aac0782e334a4d062ea9e8287efab8370d4acea29e32614157ffe3569371ff8af0564779eb327fe4cb315ccd1

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      c432efee7d9247f156890333906920c3fab1687b6b9aa0e7315b3b1062d3b3e3

    • Size

      160KB

    • MD5

      82032e9c73796524a14275d79b8e8d03

    • SHA1

      47e4da8699a78102a4f49cdd028299baecd12771

    • SHA256

      c432efee7d9247f156890333906920c3fab1687b6b9aa0e7315b3b1062d3b3e3

    • SHA512

      87b5419533cf1fa34ec14974501f21f6279ca65aac0782e334a4d062ea9e8287efab8370d4acea29e32614157ffe3569371ff8af0564779eb327fe4cb315ccd1

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks