Overview

overview

10

Static

static

8_clr.dll

windows7_x64

10

8_clr.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8_clr.dll

  • Size

    180KB

  • Sample

    211020-1h7tmahfc6

  • MD5

    f66cbe92d85e332d274af0219340e137

  • SHA1

    f9a8197d2df29347c011bbe425e059bd2aa398e5

  • SHA256

    15e08697b366cab5dbfffde7116ac38f6771d6c7f7eb430df9bf621694817e38

  • SHA512

    996075b69f27045f610f08c7da2e1a0a3cd875bf09a4ed31dd5143a0d4544f6de99e1dc74da6192517c91cd9a01f2272ead60c5eb2c2dea76e443f62a8eed8f4

Score
10/10
dridex22201botnetloader

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

155.138.203.91:443

207.180.220.242:8116

46.101.142.214:6891
rc4.plain
rc4.plain

Targets

    • Target

      8_clr.dll

    • Size

      180KB

    • MD5

      f66cbe92d85e332d274af0219340e137

    • SHA1

      f9a8197d2df29347c011bbe425e059bd2aa398e5

    • SHA256

      15e08697b366cab5dbfffde7116ac38f6771d6c7f7eb430df9bf621694817e38

    • SHA512

      996075b69f27045f610f08c7da2e1a0a3cd875bf09a4ed31dd5143a0d4544f6de99e1dc74da6192517c91cd9a01f2272ead60c5eb2c2dea76e443f62a8eed8f4

    Score
    10/10
    dridex22201botnetloader

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

      botnetloader
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks