General

  • Target

    40c2744e3e804f7e88f3e7dc13e1a39856d854ae6c10c8544663bb4fa6935965

  • Size

    162KB

  • Sample

    210629-jv78gtvg8j

  • MD5

    32f8679a26ed83e5f68655a00d7c1581

  • SHA1

    416cd18bcd198eec1e74a86371e549f5c402c8a0

  • SHA256

    40c2744e3e804f7e88f3e7dc13e1a39856d854ae6c10c8544663bb4fa6935965

  • SHA512

    a712f9cebc3722153ec40b5956276b1ee550c4ee563dbd7d7fa2496e6d2e719839caa0099da58832fc95a8e55717a63b7bb68097bcf54bf4f08cd4975629eea4

Malware Config

Extracted

Family

dridex

Botnet

40112

C2

107.172.227.10:443

172.93.133.123:2303

108.168.61.147:8172

rc4.plain
rc4.plain

Targets

    • Target

      40c2744e3e804f7e88f3e7dc13e1a39856d854ae6c10c8544663bb4fa6935965

    • Size

      162KB

    • MD5

      32f8679a26ed83e5f68655a00d7c1581

    • SHA1

      416cd18bcd198eec1e74a86371e549f5c402c8a0

    • SHA256

      40c2744e3e804f7e88f3e7dc13e1a39856d854ae6c10c8544663bb4fa6935965

    • SHA512

      a712f9cebc3722153ec40b5956276b1ee550c4ee563dbd7d7fa2496e6d2e719839caa0099da58832fc95a8e55717a63b7bb68097bcf54bf4f08cd4975629eea4

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks