General

  • Target

    0d027ad8f281ff50e4743396dd28e9ea9dce03bd9b03ab0b2208ae5f322afce1

  • Size

    160KB

  • Sample

    210627-knjbga3lm6

  • MD5

    924cf18a61ff376ab108b3146795d885

  • SHA1

    242727520b26628b5d62ff3cfe79b1c23cb7674c

  • SHA256

    0d027ad8f281ff50e4743396dd28e9ea9dce03bd9b03ab0b2208ae5f322afce1

  • SHA512

    e2c5e202d9b4507bf2731ef3ab4a4cbc35a1a799b0fcff1b6fdda972a9c3549985b68522606e631413f3f6d8d0a4543091a56ef19cd9d0742c5cbb270ffb6ee1

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      0d027ad8f281ff50e4743396dd28e9ea9dce03bd9b03ab0b2208ae5f322afce1

    • Size

      160KB

    • MD5

      924cf18a61ff376ab108b3146795d885

    • SHA1

      242727520b26628b5d62ff3cfe79b1c23cb7674c

    • SHA256

      0d027ad8f281ff50e4743396dd28e9ea9dce03bd9b03ab0b2208ae5f322afce1

    • SHA512

      e2c5e202d9b4507bf2731ef3ab4a4cbc35a1a799b0fcff1b6fdda972a9c3549985b68522606e631413f3f6d8d0a4543091a56ef19cd9d0742c5cbb270ffb6ee1

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks