General

  • Target

    27db01f225b28e8e724b78942f6819825688feae8ce8fc21da9c94976d61cadc

  • Size

    158KB

  • Sample

    210628-qkz5m9qhz6

  • MD5

    0cc75eb371ce2ccb2c30c877496b4f8f

  • SHA1

    4c1c5621455e184760b5b24a92b21eca666e4085

  • SHA256

    27db01f225b28e8e724b78942f6819825688feae8ce8fc21da9c94976d61cadc

  • SHA512

    0fddb2a2a265c376abf3831e91abf816440c476e7b56ff20b44abfdd39ca33c9b420c50f40dc539d38f48311b8f3667be86bb098b2b978eece3bd1eab8fecf76

Malware Config

Extracted

Family

dridex

Botnet

40112

C2

8.210.53.215:443

72.249.22.245:2303

188.40.137.206:8172

rc4.plain
rc4.plain

Targets

    • Target

      27db01f225b28e8e724b78942f6819825688feae8ce8fc21da9c94976d61cadc

    • Size

      158KB

    • MD5

      0cc75eb371ce2ccb2c30c877496b4f8f

    • SHA1

      4c1c5621455e184760b5b24a92b21eca666e4085

    • SHA256

      27db01f225b28e8e724b78942f6819825688feae8ce8fc21da9c94976d61cadc

    • SHA512

      0fddb2a2a265c376abf3831e91abf816440c476e7b56ff20b44abfdd39ca33c9b420c50f40dc539d38f48311b8f3667be86bb098b2b978eece3bd1eab8fecf76

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks