General

  • Target

    3d5f9670d7c7b0178fcd9c238096d4e7a1501e57694247075404eac9768a5f6a

  • Size

    160KB

  • Sample

    210626-1tzxm2dslx

  • MD5

    a016af460ccd7c334cb4faad9bf57537

  • SHA1

    04388847dad4e47bbdcabb26acf6481ee24d452f

  • SHA256

    3d5f9670d7c7b0178fcd9c238096d4e7a1501e57694247075404eac9768a5f6a

  • SHA512

    fb00cd7ea6adf90c7122e00e4d61f379016b670a6537928c401ffad50a5188f121b3afa90f139cf0516a6fac5923d3b7a4a0995331a72674e2082c4d80e96f7d

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      3d5f9670d7c7b0178fcd9c238096d4e7a1501e57694247075404eac9768a5f6a

    • Size

      160KB

    • MD5

      a016af460ccd7c334cb4faad9bf57537

    • SHA1

      04388847dad4e47bbdcabb26acf6481ee24d452f

    • SHA256

      3d5f9670d7c7b0178fcd9c238096d4e7a1501e57694247075404eac9768a5f6a

    • SHA512

      fb00cd7ea6adf90c7122e00e4d61f379016b670a6537928c401ffad50a5188f121b3afa90f139cf0516a6fac5923d3b7a4a0995331a72674e2082c4d80e96f7d

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks