Overview

overview

10

Static

static

5_SMSvcHos...es.dll

windows7_x64

10

5_SMSvcHos...es.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5_SMSvcHost.resources.dll

  • Size

    180KB

  • Sample

    211020-zcklgaheh3

  • MD5

    49b0e4b2386c4c7f9b0d3f8748bd34e8

  • SHA1

    9450b46850cc52e1128e34e0639c57ed21034991

  • SHA256

    28ce2c4d838a1de5a8bbbd10fc8b7db21c82e306338ed40933f7e107bf2a5b06

  • SHA512

    501cc133f5c88f2fd450afd74f74c1d50d9da0ce9638e8c0894f7dc89057aacd41d4b3d0f8ebe798295d2cfad63ff5fea1499e4cdde0f523a82bf92e3a408b1e

Score
10/10
dridex22201botnetloader

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

155.138.203.91:443

207.180.220.242:8116

46.101.142.214:6891
rc4.plain
rc4.plain

Targets

    • Target

      5_SMSvcHost.resources.dll

    • Size

      180KB

    • MD5

      49b0e4b2386c4c7f9b0d3f8748bd34e8

    • SHA1

      9450b46850cc52e1128e34e0639c57ed21034991

    • SHA256

      28ce2c4d838a1de5a8bbbd10fc8b7db21c82e306338ed40933f7e107bf2a5b06

    • SHA512

      501cc133f5c88f2fd450afd74f74c1d50d9da0ce9638e8c0894f7dc89057aacd41d4b3d0f8ebe798295d2cfad63ff5fea1499e4cdde0f523a82bf92e3a408b1e

    Score
    10/10
    dridex22201botnetloader

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

      botnetloader
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks