General

  • Target

    a3ff47041c0c194e35cebb1af4faaa7e9ca09035501a67e65b985b8a24d67658

  • Size

    160KB

  • Sample

    210621-nrdym9t3gs

  • MD5

    bf0f27862248edcf9e701f043f11e400

  • SHA1

    912a4bd011ed041732ab753bbd1427fbb9ea9054

  • SHA256

    a3ff47041c0c194e35cebb1af4faaa7e9ca09035501a67e65b985b8a24d67658

  • SHA512

    7ca4069a6ab889ee7bfb84adacf172aec112106a6b63d6508b47d9fb5dc73d3b2d67b415272a177e907b40ebf084cdfb6daf658973df511b83c42687f93eeb59

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      a3ff47041c0c194e35cebb1af4faaa7e9ca09035501a67e65b985b8a24d67658

    • Size

      160KB

    • MD5

      bf0f27862248edcf9e701f043f11e400

    • SHA1

      912a4bd011ed041732ab753bbd1427fbb9ea9054

    • SHA256

      a3ff47041c0c194e35cebb1af4faaa7e9ca09035501a67e65b985b8a24d67658

    • SHA512

      7ca4069a6ab889ee7bfb84adacf172aec112106a6b63d6508b47d9fb5dc73d3b2d67b415272a177e907b40ebf084cdfb6daf658973df511b83c42687f93eeb59

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks