General

  • Target

    25850daa13a1ed1f82862efa87cf90589e2751349ae3a7bc96bf6bdb9cc74d9d

  • Size

    160KB

  • Sample

    210626-87yw2preb2

  • MD5

    7303ecd034dedce4d4c77ca75b45fc79

  • SHA1

    8ce065efe67d148e78ab1d2beecf19ddfdbe08a8

  • SHA256

    25850daa13a1ed1f82862efa87cf90589e2751349ae3a7bc96bf6bdb9cc74d9d

  • SHA512

    6093121e3c22a937f880506ef42df4b263703004acdfb7140f5998d37fd6b55abaac26df04a3693b49e49fc38d987cab6917c7d756ef5c2b13cc4c9c2c9a7990

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      25850daa13a1ed1f82862efa87cf90589e2751349ae3a7bc96bf6bdb9cc74d9d

    • Size

      160KB

    • MD5

      7303ecd034dedce4d4c77ca75b45fc79

    • SHA1

      8ce065efe67d148e78ab1d2beecf19ddfdbe08a8

    • SHA256

      25850daa13a1ed1f82862efa87cf90589e2751349ae3a7bc96bf6bdb9cc74d9d

    • SHA512

      6093121e3c22a937f880506ef42df4b263703004acdfb7140f5998d37fd6b55abaac26df04a3693b49e49fc38d987cab6917c7d756ef5c2b13cc4c9c2c9a7990

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks