General

  • Target

    77e7859e269fd411377cd45b9403e0a51a79d01239e895be41528c43c31fd9f6

  • Size

    160KB

  • Sample

    210625-2ymww73lca

  • MD5

    6e46d7135be892c300e52f8f92e16cb8

  • SHA1

    6ab1398f0acfa17b1a1ad7a82b85f8184cf7e9cb

  • SHA256

    77e7859e269fd411377cd45b9403e0a51a79d01239e895be41528c43c31fd9f6

  • SHA512

    48ce570da39c92779116cb14dade0f2cb75fa854749587b317dd7a625e3553d34e074e2333fc70eb0ccfba3097fc68c9cddf3dc3f54df02a74ed9391d8556916

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      77e7859e269fd411377cd45b9403e0a51a79d01239e895be41528c43c31fd9f6

    • Size

      160KB

    • MD5

      6e46d7135be892c300e52f8f92e16cb8

    • SHA1

      6ab1398f0acfa17b1a1ad7a82b85f8184cf7e9cb

    • SHA256

      77e7859e269fd411377cd45b9403e0a51a79d01239e895be41528c43c31fd9f6

    • SHA512

      48ce570da39c92779116cb14dade0f2cb75fa854749587b317dd7a625e3553d34e074e2333fc70eb0ccfba3097fc68c9cddf3dc3f54df02a74ed9391d8556916

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks