General

  • Target

    2892cf3b1dd09e46a178abc5d7fa670f183cc43ace6bc0e4cdfb26c12d21723b

  • Size

    160KB

  • Sample

    210629-k51lzz5naj

  • MD5

    733f2d5796b5aa4c9f346f159dc8c4bc

  • SHA1

    a0ff29143325c772a814f98da8d2659eec51f24a

  • SHA256

    2892cf3b1dd09e46a178abc5d7fa670f183cc43ace6bc0e4cdfb26c12d21723b

  • SHA512

    8c30e7ecaf55fea0344482845dc0313b15301c9ccb69fc3115a176304b4e7648104db2d51f60b88193efe3809b404037eb0ceee8e259a191b03c65b0f60996c9

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      2892cf3b1dd09e46a178abc5d7fa670f183cc43ace6bc0e4cdfb26c12d21723b

    • Size

      160KB

    • MD5

      733f2d5796b5aa4c9f346f159dc8c4bc

    • SHA1

      a0ff29143325c772a814f98da8d2659eec51f24a

    • SHA256

      2892cf3b1dd09e46a178abc5d7fa670f183cc43ace6bc0e4cdfb26c12d21723b

    • SHA512

      8c30e7ecaf55fea0344482845dc0313b15301c9ccb69fc3115a176304b4e7648104db2d51f60b88193efe3809b404037eb0ceee8e259a191b03c65b0f60996c9

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks