General

  • Target

    ca205fdd8a737dbcec5bba9ec54a1dc57d125369d67bf789fd7af6ad4b4001c7

  • Size

    160KB

  • Sample

    210624-9xmxs69st2

  • MD5

    65738b2d9e1048315bf715031f5ef703

  • SHA1

    2c5c594f357b2f972ecc86d665571e53fadc7f83

  • SHA256

    ca205fdd8a737dbcec5bba9ec54a1dc57d125369d67bf789fd7af6ad4b4001c7

  • SHA512

    78f426b1500b8dc4df62ab617293e8e404803f33123a1f90a4239dae2ca12913e55ad90684d16f6533880984f07c4832cb19261bdf405f66a84aea415e034043

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      ca205fdd8a737dbcec5bba9ec54a1dc57d125369d67bf789fd7af6ad4b4001c7

    • Size

      160KB

    • MD5

      65738b2d9e1048315bf715031f5ef703

    • SHA1

      2c5c594f357b2f972ecc86d665571e53fadc7f83

    • SHA256

      ca205fdd8a737dbcec5bba9ec54a1dc57d125369d67bf789fd7af6ad4b4001c7

    • SHA512

      78f426b1500b8dc4df62ab617293e8e404803f33123a1f90a4239dae2ca12913e55ad90684d16f6533880984f07c4832cb19261bdf405f66a84aea415e034043

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks