General

  • Target

    0e7a6028a3589231e73262f5a7e5c6136183bdb7fb7d92a1af1a943db9663751

  • Size

    160KB

  • Sample

    210629-vqqp3m13zj

  • MD5

    22abf6bf921d5786b7ac2de6a563c443

  • SHA1

    8a6aabd4e448fe00fa07dfa439cf6c9de0db8c2e

  • SHA256

    0e7a6028a3589231e73262f5a7e5c6136183bdb7fb7d92a1af1a943db9663751

  • SHA512

    e94afa2b557162e4859f98e060cd0704fb3e03c46e8a2634d3d80d0761c491c45c5dde54751ccf94c6eb3c8c49f9b48cd33f8b6f08f7c1bf2cf519e1f81de227

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      0e7a6028a3589231e73262f5a7e5c6136183bdb7fb7d92a1af1a943db9663751

    • Size

      160KB

    • MD5

      22abf6bf921d5786b7ac2de6a563c443

    • SHA1

      8a6aabd4e448fe00fa07dfa439cf6c9de0db8c2e

    • SHA256

      0e7a6028a3589231e73262f5a7e5c6136183bdb7fb7d92a1af1a943db9663751

    • SHA512

      e94afa2b557162e4859f98e060cd0704fb3e03c46e8a2634d3d80d0761c491c45c5dde54751ccf94c6eb3c8c49f9b48cd33f8b6f08f7c1bf2cf519e1f81de227

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks