General

  • Target

    11979f35c1c32ea1226f79d0d4fa35b5ff3680192ac1cea11e1e3b4ff3da0b9d

  • Size

    158KB

  • Sample

    210628-w1e3dmspba

  • MD5

    637092e00fed9753b773efb368c2c23d

  • SHA1

    ce1a6dc7707bafb53468ec72543db927052c2069

  • SHA256

    11979f35c1c32ea1226f79d0d4fa35b5ff3680192ac1cea11e1e3b4ff3da0b9d

  • SHA512

    556bf688034abfcd653f4da56f2cfbb2c3d1006ccc2f6c2fd18d8f250053fc0ca5b37e9a3a2a823bfc09b8adf56320ada32c037d286855d49a51d0cc60cd7f62

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

8.210.53.215:443

72.249.22.245:2303

188.40.137.206:8172

rc4.plain
rc4.plain

Targets

    • Target

      11979f35c1c32ea1226f79d0d4fa35b5ff3680192ac1cea11e1e3b4ff3da0b9d

    • Size

      158KB

    • MD5

      637092e00fed9753b773efb368c2c23d

    • SHA1

      ce1a6dc7707bafb53468ec72543db927052c2069

    • SHA256

      11979f35c1c32ea1226f79d0d4fa35b5ff3680192ac1cea11e1e3b4ff3da0b9d

    • SHA512

      556bf688034abfcd653f4da56f2cfbb2c3d1006ccc2f6c2fd18d8f250053fc0ca5b37e9a3a2a823bfc09b8adf56320ada32c037d286855d49a51d0cc60cd7f62

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks