General

  • Target

    ba0e3f29bfcc65f7a3bed0b8f4017cf11a2583dcab8d8c01509dba46ff8bdae3

  • Size

    160KB

  • Sample

    210627-3nefh951m2

  • MD5

    d3463cf5cddf7db352820e7ff5602164

  • SHA1

    c89e0c074c8a19036d452060421ca3d050f5f6f1

  • SHA256

    ba0e3f29bfcc65f7a3bed0b8f4017cf11a2583dcab8d8c01509dba46ff8bdae3

  • SHA512

    72aaab0d4e4a1d23b7058a8c008974a08635d19f7e21ce155315888074a3e625c20e1fbd64a6716b735b0c278c9b6331c5f3fbf9238adb3aaa500cebd2f0fddc

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      ba0e3f29bfcc65f7a3bed0b8f4017cf11a2583dcab8d8c01509dba46ff8bdae3

    • Size

      160KB

    • MD5

      d3463cf5cddf7db352820e7ff5602164

    • SHA1

      c89e0c074c8a19036d452060421ca3d050f5f6f1

    • SHA256

      ba0e3f29bfcc65f7a3bed0b8f4017cf11a2583dcab8d8c01509dba46ff8bdae3

    • SHA512

      72aaab0d4e4a1d23b7058a8c008974a08635d19f7e21ce155315888074a3e625c20e1fbd64a6716b735b0c278c9b6331c5f3fbf9238adb3aaa500cebd2f0fddc

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks