General

  • Target

    6a7b2f3e64087b3c42e0d290bb84fbef9c3f4a53cd1b30aebfb1ac3e6514949f

  • Size

    160KB

  • Sample

    210629-vwskwlkdv6

  • MD5

    ef878c386a1d2581e52d36165a24677d

  • SHA1

    f48ed6bf13015676ea78284124b87445861eb238

  • SHA256

    6a7b2f3e64087b3c42e0d290bb84fbef9c3f4a53cd1b30aebfb1ac3e6514949f

  • SHA512

    e744bc47a6d8f96c9761d0609cc463f8664a986b4e269ad3a3506f07dbdff09af273a8bc05cd352732eb69a2bc376fa65e6a1277ba4a8578f1016b8e191cf4ce

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Targets

    • Target

      6a7b2f3e64087b3c42e0d290bb84fbef9c3f4a53cd1b30aebfb1ac3e6514949f

    • Size

      160KB

    • MD5

      ef878c386a1d2581e52d36165a24677d

    • SHA1

      f48ed6bf13015676ea78284124b87445861eb238

    • SHA256

      6a7b2f3e64087b3c42e0d290bb84fbef9c3f4a53cd1b30aebfb1ac3e6514949f

    • SHA512

      e744bc47a6d8f96c9761d0609cc463f8664a986b4e269ad3a3506f07dbdff09af273a8bc05cd352732eb69a2bc376fa65e6a1277ba4a8578f1016b8e191cf4ce

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks