General

  • Target

    03b617b9b8e77b1dd3e011040e7e86764036d5d0dab2fe485868261d68d1ad4f

  • Size

    160KB

  • Sample

    210622-vq9jqexp7s

  • MD5

    c02f62e0c87cf862a955a4cd5a407731

  • SHA1

    dab7f65cb675741ab10696629332bf78d9208f00

  • SHA256

    03b617b9b8e77b1dd3e011040e7e86764036d5d0dab2fe485868261d68d1ad4f

  • SHA512

    a2368e33e7fafda394248842dff6c7e6cbbf292ae61c54b8e471027961d3025c03e4611e071b4fe43cea890c870bdd013ccbf36fe2f619ce41cdbe979137d0ff

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      03b617b9b8e77b1dd3e011040e7e86764036d5d0dab2fe485868261d68d1ad4f

    • Size

      160KB

    • MD5

      c02f62e0c87cf862a955a4cd5a407731

    • SHA1

      dab7f65cb675741ab10696629332bf78d9208f00

    • SHA256

      03b617b9b8e77b1dd3e011040e7e86764036d5d0dab2fe485868261d68d1ad4f

    • SHA512

      a2368e33e7fafda394248842dff6c7e6cbbf292ae61c54b8e471027961d3025c03e4611e071b4fe43cea890c870bdd013ccbf36fe2f619ce41cdbe979137d0ff

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks