General

  • Target

    6fb8a9549c3e6d8c980d25f652fc2801317372cd6ea1bcf13014d4343f7ca299

  • Size

    160KB

  • Sample

    210626-yf1ps121gx

  • MD5

    238300afe5851fe6d202c7b1aab46791

  • SHA1

    2183a94fda3b7d2a923cab5b13bbfa5091d37f2d

  • SHA256

    6fb8a9549c3e6d8c980d25f652fc2801317372cd6ea1bcf13014d4343f7ca299

  • SHA512

    6739f37d0307905d4873a0a7fc7153ad96acdeab0f0c1040fe00d14f677c339298f66412ca620478f412997ee102b126f04b44c68cac3136375fe72938075eb9

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      6fb8a9549c3e6d8c980d25f652fc2801317372cd6ea1bcf13014d4343f7ca299

    • Size

      160KB

    • MD5

      238300afe5851fe6d202c7b1aab46791

    • SHA1

      2183a94fda3b7d2a923cab5b13bbfa5091d37f2d

    • SHA256

      6fb8a9549c3e6d8c980d25f652fc2801317372cd6ea1bcf13014d4343f7ca299

    • SHA512

      6739f37d0307905d4873a0a7fc7153ad96acdeab0f0c1040fe00d14f677c339298f66412ca620478f412997ee102b126f04b44c68cac3136375fe72938075eb9

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks