General

  • Target

    23eefe4b0d544944cab6267d31b46b70197efb30dd130d0e2af00abfc7b99c7c

  • Size

    160KB

  • Sample

    210629-kqgh76477x

  • MD5

    4a8ec2f7271c2f7dd7d3757dae02b39c

  • SHA1

    0a9fabd612d88b2237d1750b83fce21536684b4b

  • SHA256

    23eefe4b0d544944cab6267d31b46b70197efb30dd130d0e2af00abfc7b99c7c

  • SHA512

    126a4ca9374b3253d0a92a4370c27efa228f145b7c1802e8c1d107f0a9b5dbab0db0fe1e4742a6a460c967f792894975cae3d9bf424023a08a5e340d56b42ba1

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      23eefe4b0d544944cab6267d31b46b70197efb30dd130d0e2af00abfc7b99c7c

    • Size

      160KB

    • MD5

      4a8ec2f7271c2f7dd7d3757dae02b39c

    • SHA1

      0a9fabd612d88b2237d1750b83fce21536684b4b

    • SHA256

      23eefe4b0d544944cab6267d31b46b70197efb30dd130d0e2af00abfc7b99c7c

    • SHA512

      126a4ca9374b3253d0a92a4370c27efa228f145b7c1802e8c1d107f0a9b5dbab0db0fe1e4742a6a460c967f792894975cae3d9bf424023a08a5e340d56b42ba1

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks