General

  • Target

    4f1879f0223411dc5664df5856f9b2ee3fca89f684b9e15185fc05888bbc322d

  • Size

    160KB

  • Sample

    210626-4m5p2frnjn

  • MD5

    12fff697a24d1c68d6b044800660003c

  • SHA1

    3a437470a569205f160988c2750771f35de5f150

  • SHA256

    4f1879f0223411dc5664df5856f9b2ee3fca89f684b9e15185fc05888bbc322d

  • SHA512

    1ed7a810528cb089978dbeb1158d4e8ea5987f2646a132ee13587b1f84c8ef6faec67f7d99f1e84650389b2528bb982aba05a6c34267203666ec11b62501017e

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      4f1879f0223411dc5664df5856f9b2ee3fca89f684b9e15185fc05888bbc322d

    • Size

      160KB

    • MD5

      12fff697a24d1c68d6b044800660003c

    • SHA1

      3a437470a569205f160988c2750771f35de5f150

    • SHA256

      4f1879f0223411dc5664df5856f9b2ee3fca89f684b9e15185fc05888bbc322d

    • SHA512

      1ed7a810528cb089978dbeb1158d4e8ea5987f2646a132ee13587b1f84c8ef6faec67f7d99f1e84650389b2528bb982aba05a6c34267203666ec11b62501017e

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks