General

  • Target

    cbcbd8b53748cac59ad0d253ca10baf051e0fb8168d65d1f0e7eb15bff5d074f

  • Size

    158KB

  • Sample

    210623-2pghf7wkvx

  • MD5

    e7ac89e26c5b8f0d2a019df83f0bf429

  • SHA1

    6b2f2310f04271dc762e327f8546c161ca4719e0

  • SHA256

    cbcbd8b53748cac59ad0d253ca10baf051e0fb8168d65d1f0e7eb15bff5d074f

  • SHA512

    d04e89e509048ff0ba44b4f12d1bd7e7ea7f583a3dcdf7614a6e826b168b211865f0cf26db8520b2ab2270da6a098b092b1aa7ac1d14a6f75bd19dbdb9b6136c

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

8.210.53.215:443

72.249.22.245:2303

188.40.137.206:8172

rc4.plain
rc4.plain

Targets

    • Target

      cbcbd8b53748cac59ad0d253ca10baf051e0fb8168d65d1f0e7eb15bff5d074f

    • Size

      158KB

    • MD5

      e7ac89e26c5b8f0d2a019df83f0bf429

    • SHA1

      6b2f2310f04271dc762e327f8546c161ca4719e0

    • SHA256

      cbcbd8b53748cac59ad0d253ca10baf051e0fb8168d65d1f0e7eb15bff5d074f

    • SHA512

      d04e89e509048ff0ba44b4f12d1bd7e7ea7f583a3dcdf7614a6e826b168b211865f0cf26db8520b2ab2270da6a098b092b1aa7ac1d14a6f75bd19dbdb9b6136c

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks