Overview

overview

10

Static

static

jdfggo.dll

windows7_x64

10

jdfggo.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    jdfggo.rar

  • Size

    328KB

  • Sample

    220626-gdb2lsbab8

  • MD5

    6e6533fa01c0c32dac8c1cab8dc73dbc

  • SHA1

    44c67e51fbeb6b0c8bc26cf7d21223403cac4215

  • SHA256

    14cf7f5e94dba384b0e31ad0917b6825b9f9791625059cc8b3c0db43931c9cc9

  • SHA512

    270bdf93dbd36c946fbc45020619c3ed31d46e659c7ff9d8cb28d9d713a30bb78e7d3d2fed4069a5420ecbea61d4cbeff44bd7d0b6afb6caeb43fb5ff12c8a24

Score
10/10
dridex10444botnetloader

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

45.79.8.25:443

185.201.9.197:9443

217.160.78.166:4664

108.175.9.22:33443
rc4.plain
rc4.plain

Targets

    • Target

      jdfggo.rar

    • Size

      328KB

    • MD5

      6e6533fa01c0c32dac8c1cab8dc73dbc

    • SHA1

      44c67e51fbeb6b0c8bc26cf7d21223403cac4215

    • SHA256

      14cf7f5e94dba384b0e31ad0917b6825b9f9791625059cc8b3c0db43931c9cc9

    • SHA512

      270bdf93dbd36c946fbc45020619c3ed31d46e659c7ff9d8cb28d9d713a30bb78e7d3d2fed4069a5420ecbea61d4cbeff44bd7d0b6afb6caeb43fb5ff12c8a24

    Score
    10/10
    dridex10444botnetloader

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Loader 'dmod' strings

      Detects 'dmod' strings in Dridex loader.

      botnetloader
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks