General

  • Target

    5f95f9a8a4d0430a5b47a2c52e43f9f28cfb4b78b7063a7b5811f2d272adef95

  • Size

    160KB

  • Sample

    210622-t5s64z8hxs

  • MD5

    2496ac26b340658038a9ebeca38c6c15

  • SHA1

    3f73e96a1981164d22d23e6768f9fecd7d6d40e8

  • SHA256

    5f95f9a8a4d0430a5b47a2c52e43f9f28cfb4b78b7063a7b5811f2d272adef95

  • SHA512

    0085d1d63387e816650c8e9360afd49598421272b47625c52d95b43a6ec905bc0d388db495897f0a389c8c709c453600af4cc428423841e8daeeb284660d5560

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      5f95f9a8a4d0430a5b47a2c52e43f9f28cfb4b78b7063a7b5811f2d272adef95

    • Size

      160KB

    • MD5

      2496ac26b340658038a9ebeca38c6c15

    • SHA1

      3f73e96a1981164d22d23e6768f9fecd7d6d40e8

    • SHA256

      5f95f9a8a4d0430a5b47a2c52e43f9f28cfb4b78b7063a7b5811f2d272adef95

    • SHA512

      0085d1d63387e816650c8e9360afd49598421272b47625c52d95b43a6ec905bc0d388db495897f0a389c8c709c453600af4cc428423841e8daeeb284660d5560

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks