General

  • Target

    fcce858b8d20725635a90fac35047cd00940e0dc15169ceb279a370b23ca5326

  • Size

    160KB

  • Sample

    210626-p93kf3w3ca

  • MD5

    108e229dbab08063b23f7a9b83aae307

  • SHA1

    9b16780c556eb14b2d28430ad8e3bfdf7ba0b5f8

  • SHA256

    fcce858b8d20725635a90fac35047cd00940e0dc15169ceb279a370b23ca5326

  • SHA512

    823378e46e392fcca93154ce75694878f027f3b31e65598e9b3807e6c7e141166eacbdc4a3969ebed9082a106046c27398755d2845db3773420542a41aea7b9d

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      fcce858b8d20725635a90fac35047cd00940e0dc15169ceb279a370b23ca5326

    • Size

      160KB

    • MD5

      108e229dbab08063b23f7a9b83aae307

    • SHA1

      9b16780c556eb14b2d28430ad8e3bfdf7ba0b5f8

    • SHA256

      fcce858b8d20725635a90fac35047cd00940e0dc15169ceb279a370b23ca5326

    • SHA512

      823378e46e392fcca93154ce75694878f027f3b31e65598e9b3807e6c7e141166eacbdc4a3969ebed9082a106046c27398755d2845db3773420542a41aea7b9d

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks