General

  • Target

    8c8dae68eb5ee6c71e8d66944e39878ffae14d92464915be442a4ea18e899135

  • Size

    160KB

  • Sample

    210628-4jlfzqyte6

  • MD5

    354992a536651f842a0e3b2ad49893ab

  • SHA1

    ecc09aba373d2db1d5b24584af0ca673b3aac8f2

  • SHA256

    8c8dae68eb5ee6c71e8d66944e39878ffae14d92464915be442a4ea18e899135

  • SHA512

    cacc593ae8bbf0e354930bc15fadf31e3a47b9f6c37316ff156b7406416732a2b2d532eb3df916e8292e2edc64754ec508b3f43c869408dbec1a5a5ff8351b5e

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      8c8dae68eb5ee6c71e8d66944e39878ffae14d92464915be442a4ea18e899135

    • Size

      160KB

    • MD5

      354992a536651f842a0e3b2ad49893ab

    • SHA1

      ecc09aba373d2db1d5b24584af0ca673b3aac8f2

    • SHA256

      8c8dae68eb5ee6c71e8d66944e39878ffae14d92464915be442a4ea18e899135

    • SHA512

      cacc593ae8bbf0e354930bc15fadf31e3a47b9f6c37316ff156b7406416732a2b2d532eb3df916e8292e2edc64754ec508b3f43c869408dbec1a5a5ff8351b5e

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks