General

  • Target

    21d937a10c43f18bd1929e2778e32219d2918f56bae4ab8ef7c7560f3ca73ef7

  • Size

    160KB

  • Sample

    210621-z2fh5c6tgx

  • MD5

    c989d2b786016fe1f69bc62c20c40810

  • SHA1

    8e4b7537086a6278620f7af4bdf4a81345bc593c

  • SHA256

    21d937a10c43f18bd1929e2778e32219d2918f56bae4ab8ef7c7560f3ca73ef7

  • SHA512

    5587ece99175d1658911710ecf533eba69cb59bca0fff10fcc2d9daacacad38c5c19015be115c6b8f5f8cf1b0dd57fc52feb38d2de2fb23c7a68c241fd1cdbda

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      21d937a10c43f18bd1929e2778e32219d2918f56bae4ab8ef7c7560f3ca73ef7

    • Size

      160KB

    • MD5

      c989d2b786016fe1f69bc62c20c40810

    • SHA1

      8e4b7537086a6278620f7af4bdf4a81345bc593c

    • SHA256

      21d937a10c43f18bd1929e2778e32219d2918f56bae4ab8ef7c7560f3ca73ef7

    • SHA512

      5587ece99175d1658911710ecf533eba69cb59bca0fff10fcc2d9daacacad38c5c19015be115c6b8f5f8cf1b0dd57fc52feb38d2de2fb23c7a68c241fd1cdbda

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks