General

  • Target

    df2a821de79abd14ba6f7629dfaf002deaf930c90f31c41701cf8a3bfa229d71

  • Size

    160KB

  • Sample

    210629-ejhrw2de1s

  • MD5

    c6b6c7fb8a1ffac09171a7d3c742ea9b

  • SHA1

    3bd42478e1a0e21800b1d4c1a0369545eec264eb

  • SHA256

    df2a821de79abd14ba6f7629dfaf002deaf930c90f31c41701cf8a3bfa229d71

  • SHA512

    365fb44080329bc12c6d09645d3ad0510b8fec0ead963fb694ef4636f3fce5938007c16798b93c5a94473f639bcabf21f79129efeb3de2dcf5cc9c29a0848022

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      df2a821de79abd14ba6f7629dfaf002deaf930c90f31c41701cf8a3bfa229d71

    • Size

      160KB

    • MD5

      c6b6c7fb8a1ffac09171a7d3c742ea9b

    • SHA1

      3bd42478e1a0e21800b1d4c1a0369545eec264eb

    • SHA256

      df2a821de79abd14ba6f7629dfaf002deaf930c90f31c41701cf8a3bfa229d71

    • SHA512

      365fb44080329bc12c6d09645d3ad0510b8fec0ead963fb694ef4636f3fce5938007c16798b93c5a94473f639bcabf21f79129efeb3de2dcf5cc9c29a0848022

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks