General

  • Target

    dee810a990fd2009736af5cf726ff7228859b4ba83ff2cbb0544cdb48b74317f

  • Size

    160KB

  • Sample

    210627-6bglqg8qfx

  • MD5

    b422cf93815b6ae847fd731a3028738d

  • SHA1

    fe24bbfc167fad5c530f91e8eb4cb7c1bdba1107

  • SHA256

    dee810a990fd2009736af5cf726ff7228859b4ba83ff2cbb0544cdb48b74317f

  • SHA512

    67a0d6ee2a641410bd4e1bd0910a3c260822067dd4804087159e2531ec5f1ee4002d5c718ac3b3584bb2207c043e2e59bfbb25f8c6002f7b8960f2c48acf31d3

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      dee810a990fd2009736af5cf726ff7228859b4ba83ff2cbb0544cdb48b74317f

    • Size

      160KB

    • MD5

      b422cf93815b6ae847fd731a3028738d

    • SHA1

      fe24bbfc167fad5c530f91e8eb4cb7c1bdba1107

    • SHA256

      dee810a990fd2009736af5cf726ff7228859b4ba83ff2cbb0544cdb48b74317f

    • SHA512

      67a0d6ee2a641410bd4e1bd0910a3c260822067dd4804087159e2531ec5f1ee4002d5c718ac3b3584bb2207c043e2e59bfbb25f8c6002f7b8960f2c48acf31d3

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks