Overview

overview

10

Static

static

8_GrooveAudio.dll

windows7_x64

10

8_GrooveAudio.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8_GrooveAudio.dll

  • Size

    180KB

  • Sample

    211018-tcp83adha6

  • MD5

    21187c4bfcd9fd36f9543feb063427c4

  • SHA1

    9cd287cdc9d005455e5c79791626d97cf14a1849

  • SHA256

    6baba00a0fe93619aa35d3aac856b7a063134ee57565a36ac3aa6a1bbdc54d57

  • SHA512

    b98d4dd445197134622a74e26a8cda3a02d66326d919ed354772937f3f1522bc94a5cab8a963ee1533526b389284c936ab15b940e88257091bdda6f9f5fbd94b

Score
10/10
dridex22203botnetloader

Malware Config

Extracted

Family

dridex

Botnet

22203

C2

195.154.146.84:443

45.56.121.87:8116

157.245.222.44:5723
rc4.plain
rc4.plain

Targets

    • Target

      8_GrooveAudio.dll

    • Size

      180KB

    • MD5

      21187c4bfcd9fd36f9543feb063427c4

    • SHA1

      9cd287cdc9d005455e5c79791626d97cf14a1849

    • SHA256

      6baba00a0fe93619aa35d3aac856b7a063134ee57565a36ac3aa6a1bbdc54d57

    • SHA512

      b98d4dd445197134622a74e26a8cda3a02d66326d919ed354772937f3f1522bc94a5cab8a963ee1533526b389284c936ab15b940e88257091bdda6f9f5fbd94b

    Score
    10/10
    dridex22203botnetloader

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

      botnetloader
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks