General

  • Target

    2232640adce8fe12bc30f3113c6b0316ad0074d4d5eef20fc20e1fd88e7a32bb

  • Size

    160KB

  • Sample

    210621-vh2f1jsel6

  • MD5

    0f8e75c77a2636fe81be13d14dc22f9a

  • SHA1

    0801b9ff65baf31f7391280608fe268baf2c30ec

  • SHA256

    2232640adce8fe12bc30f3113c6b0316ad0074d4d5eef20fc20e1fd88e7a32bb

  • SHA512

    35e14b0e9e477958b9ae47aff41788433d9efa58cfa38bcfed914d7f69743e3f33cc1863f22f8f978fe6b26c17366f3e005feb49431e47a0366f1d2b6d840181

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      2232640adce8fe12bc30f3113c6b0316ad0074d4d5eef20fc20e1fd88e7a32bb

    • Size

      160KB

    • MD5

      0f8e75c77a2636fe81be13d14dc22f9a

    • SHA1

      0801b9ff65baf31f7391280608fe268baf2c30ec

    • SHA256

      2232640adce8fe12bc30f3113c6b0316ad0074d4d5eef20fc20e1fd88e7a32bb

    • SHA512

      35e14b0e9e477958b9ae47aff41788433d9efa58cfa38bcfed914d7f69743e3f33cc1863f22f8f978fe6b26c17366f3e005feb49431e47a0366f1d2b6d840181

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks