Overview

overview

10

Static

static

2_api-ms-w...-0.dll

windows7_x64

10

2_api-ms-w...-0.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2_api-ms-win-downlevel-normaliz-l1-1-0.dll

  • Size

    180KB

  • Sample

    211021-xn996aafd6

  • MD5

    00752a06db0eacfd3b09e36d3a3d29c6

  • SHA1

    9afd6ace7a8b25a58450cf7ec16db38a480c32dc

  • SHA256

    e8291c194029eedc2117c099b3089a252dfb940160530409df4b9ea85efc9033

  • SHA512

    1895a988c678e30ceac1afb421dc29fc6531617b0a5497ec50ae90b2cf85bf62724ad830576e9394cecd6f334f864fa6630a763671b30a91dfe0aa052315ebfe

Score
10/10
dridex22201botnetloader

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

212.237.17.99:443

176.28.17.160:6602

51.254.140.238:8333
rc4.plain
rc4.plain

Targets

    • Target

      2_api-ms-win-downlevel-normaliz-l1-1-0.dll

    • Size

      180KB

    • MD5

      00752a06db0eacfd3b09e36d3a3d29c6

    • SHA1

      9afd6ace7a8b25a58450cf7ec16db38a480c32dc

    • SHA256

      e8291c194029eedc2117c099b3089a252dfb940160530409df4b9ea85efc9033

    • SHA512

      1895a988c678e30ceac1afb421dc29fc6531617b0a5497ec50ae90b2cf85bf62724ad830576e9394cecd6f334f864fa6630a763671b30a91dfe0aa052315ebfe

    Score
    10/10
    dridex22201botnetloader

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

      botnetloader
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks