General

  • Target

    a11bf5db5d88579f37253a8949e6d9b25889cdef228ea1818dd34a5e2215d0e8

  • Size

    158KB

  • Sample

    210620-vrnkab8x2j

  • MD5

    01b2896652f3a81b1cb8d7b185728872

  • SHA1

    916781efec64bee0095358b914a7add4b0e1d278

  • SHA256

    a11bf5db5d88579f37253a8949e6d9b25889cdef228ea1818dd34a5e2215d0e8

  • SHA512

    6a08ff7bb80844628a6e970d2f8d6d029e12c49aa61b0d961ac57dfe92f5eb543139fd75e93c8c9924a46337be7cbcaf3b9eefe9d89439facad94879a6ca53ae

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

8.210.53.215:443

72.249.22.245:2303

188.40.137.206:8172

rc4.plain
rc4.plain

Targets

    • Target

      a11bf5db5d88579f37253a8949e6d9b25889cdef228ea1818dd34a5e2215d0e8

    • Size

      158KB

    • MD5

      01b2896652f3a81b1cb8d7b185728872

    • SHA1

      916781efec64bee0095358b914a7add4b0e1d278

    • SHA256

      a11bf5db5d88579f37253a8949e6d9b25889cdef228ea1818dd34a5e2215d0e8

    • SHA512

      6a08ff7bb80844628a6e970d2f8d6d029e12c49aa61b0d961ac57dfe92f5eb543139fd75e93c8c9924a46337be7cbcaf3b9eefe9d89439facad94879a6ca53ae

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks