General

  • Target

    30b41b9341f44b9a316606eb0ad06236b8f331aa524e5736018f4e75ddc3c038

  • Size

    160KB

  • Sample

    210621-thv6a9qxnj

  • MD5

    2a5f674c1d211d7161b3ac8c6d349bf0

  • SHA1

    87e9625396e803870b31e4a4e322cc63815a9e5f

  • SHA256

    30b41b9341f44b9a316606eb0ad06236b8f331aa524e5736018f4e75ddc3c038

  • SHA512

    745a6208444aadf76dac0e6154c85fea1eb8284ac9eee3ba760502e2e4131d29a24428a032f9012411dd81c9d0fedbcb6e690435f89c858498c054e3dd6fffff

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      30b41b9341f44b9a316606eb0ad06236b8f331aa524e5736018f4e75ddc3c038

    • Size

      160KB

    • MD5

      2a5f674c1d211d7161b3ac8c6d349bf0

    • SHA1

      87e9625396e803870b31e4a4e322cc63815a9e5f

    • SHA256

      30b41b9341f44b9a316606eb0ad06236b8f331aa524e5736018f4e75ddc3c038

    • SHA512

      745a6208444aadf76dac0e6154c85fea1eb8284ac9eee3ba760502e2e4131d29a24428a032f9012411dd81c9d0fedbcb6e690435f89c858498c054e3dd6fffff

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks