General

  • Target

    9e34cc7d5cc172c9d4fd1066ed4e1f0c47603fd21526a8a7fa6814dfce70c04c

  • Size

    160KB

  • Sample

    210627-rca6wnj8da

  • MD5

    fc32545b3fae4e144ff36c3a0e76dd27

  • SHA1

    3e38dbc1515223d699612843502a2fdd80e8e0c1

  • SHA256

    9e34cc7d5cc172c9d4fd1066ed4e1f0c47603fd21526a8a7fa6814dfce70c04c

  • SHA512

    5a22c80c9b72d00dd19f91fca3da26950686123be66937b3a8976e7e4bee83e2c484fe9d6f44138a9e21d896003c3f17ab25bbef60e251569144da1aed4d2839

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      9e34cc7d5cc172c9d4fd1066ed4e1f0c47603fd21526a8a7fa6814dfce70c04c

    • Size

      160KB

    • MD5

      fc32545b3fae4e144ff36c3a0e76dd27

    • SHA1

      3e38dbc1515223d699612843502a2fdd80e8e0c1

    • SHA256

      9e34cc7d5cc172c9d4fd1066ed4e1f0c47603fd21526a8a7fa6814dfce70c04c

    • SHA512

      5a22c80c9b72d00dd19f91fca3da26950686123be66937b3a8976e7e4bee83e2c484fe9d6f44138a9e21d896003c3f17ab25bbef60e251569144da1aed4d2839

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks