General

  • Target

    eb1e587a916f4f999e7a2d0721db15f873e65e9285a51aa2573f9820ab512fa7

  • Size

    160KB

  • Sample

    210620-zk7n63cxzn

  • MD5

    a1399fa8b7bb8346a5582b16ea7eb8ac

  • SHA1

    5c60ba7ab295934106a24ab17ad359a547a5e050

  • SHA256

    eb1e587a916f4f999e7a2d0721db15f873e65e9285a51aa2573f9820ab512fa7

  • SHA512

    1aca64918c43948be407c82f751aeed6261fe19fcc260bc97595c04c70fc7eadb81199f2c5bb7d20f5e21510ab32e9deee07445c1eefdae00eb55c78f9ee64d4

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      eb1e587a916f4f999e7a2d0721db15f873e65e9285a51aa2573f9820ab512fa7

    • Size

      160KB

    • MD5

      a1399fa8b7bb8346a5582b16ea7eb8ac

    • SHA1

      5c60ba7ab295934106a24ab17ad359a547a5e050

    • SHA256

      eb1e587a916f4f999e7a2d0721db15f873e65e9285a51aa2573f9820ab512fa7

    • SHA512

      1aca64918c43948be407c82f751aeed6261fe19fcc260bc97595c04c70fc7eadb81199f2c5bb7d20f5e21510ab32e9deee07445c1eefdae00eb55c78f9ee64d4

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks