General

  • Target

    dbfea133fada15034415373416d6702572804009b18f280cd0f0363fd7221106

  • Size

    160KB

  • Sample

    210628-1hypampj6x

  • MD5

    1954304d47b4480c15215b158e3b866c

  • SHA1

    3daa1a03a108e3f39523716a209661b70fde8052

  • SHA256

    dbfea133fada15034415373416d6702572804009b18f280cd0f0363fd7221106

  • SHA512

    878e65fb0c68a42abe17f02b0da7b5f4c36735f656afd9824b9bafb98e8dc9ffc62c3bee3e6b02c748fbbbbde21e331bdfc16cfc27920f050b76c510be32da1f

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      dbfea133fada15034415373416d6702572804009b18f280cd0f0363fd7221106

    • Size

      160KB

    • MD5

      1954304d47b4480c15215b158e3b866c

    • SHA1

      3daa1a03a108e3f39523716a209661b70fde8052

    • SHA256

      dbfea133fada15034415373416d6702572804009b18f280cd0f0363fd7221106

    • SHA512

      878e65fb0c68a42abe17f02b0da7b5f4c36735f656afd9824b9bafb98e8dc9ffc62c3bee3e6b02c748fbbbbde21e331bdfc16cfc27920f050b76c510be32da1f

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks