General

  • Target

    74b4902606afc0653419e6af521774dfb689468af87abaf49e71f8aca0aaacbb

  • Size

    160KB

  • Sample

    210623-99mkthmw6j

  • MD5

    86a9537520c79ab00917b22c46abfe20

  • SHA1

    77c70fb140872f1335b09a5ade0135076d2fe5c3

  • SHA256

    74b4902606afc0653419e6af521774dfb689468af87abaf49e71f8aca0aaacbb

  • SHA512

    a4e17409727417a9697d3427439e4e50ba4052a60a669744c57027a5e4a662efb410a0ba65dab21bd630950d0ae75ec4541277ad70d2d07ddfe8cffda4778edb

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      74b4902606afc0653419e6af521774dfb689468af87abaf49e71f8aca0aaacbb

    • Size

      160KB

    • MD5

      86a9537520c79ab00917b22c46abfe20

    • SHA1

      77c70fb140872f1335b09a5ade0135076d2fe5c3

    • SHA256

      74b4902606afc0653419e6af521774dfb689468af87abaf49e71f8aca0aaacbb

    • SHA512

      a4e17409727417a9697d3427439e4e50ba4052a60a669744c57027a5e4a662efb410a0ba65dab21bd630950d0ae75ec4541277ad70d2d07ddfe8cffda4778edb

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks