General

  • Target

    2e35bb8205dc60835da98ed533786b447fcdf79f1a824df5fb39da1350e94524

  • Size

    162KB

  • Sample

    210629-ymnda4kqp2

  • MD5

    47a1112f5ce06eda6d6928963389d9f2

  • SHA1

    3f85bb6b51d752da1c8bd159a0a6c361b311b18c

  • SHA256

    2e35bb8205dc60835da98ed533786b447fcdf79f1a824df5fb39da1350e94524

  • SHA512

    94c63e5ea4afff94e0ec8fafc00c6e7c7fd7707743b1d0f97eae9af18bd5d34171254ebbe72c093ae80ad0f932c9a94c82481550a083fbd95c8b2264dd1d099d

Malware Config

Extracted

Family

dridex

Botnet

40112

C2

107.172.227.10:443

172.93.133.123:2303

108.168.61.147:8172

rc4.plain
rc4.plain

Targets

    • Target

      2e35bb8205dc60835da98ed533786b447fcdf79f1a824df5fb39da1350e94524

    • Size

      162KB

    • MD5

      47a1112f5ce06eda6d6928963389d9f2

    • SHA1

      3f85bb6b51d752da1c8bd159a0a6c361b311b18c

    • SHA256

      2e35bb8205dc60835da98ed533786b447fcdf79f1a824df5fb39da1350e94524

    • SHA512

      94c63e5ea4afff94e0ec8fafc00c6e7c7fd7707743b1d0f97eae9af18bd5d34171254ebbe72c093ae80ad0f932c9a94c82481550a083fbd95c8b2264dd1d099d

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks