Overview

overview

10

Static

static

wisr1qas.dll

windows7_x64

10

wisr1qas.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    wisr1qas.jpg

  • Size

    476KB

  • Sample

    220626-gz4czsbfe7

  • MD5

    f7703084b13482c646f3851e18d8951a

  • SHA1

    939ff0c3db869fa5656b6905f824fdb69050e43c

  • SHA256

    b98be8d2e7d160dacbd6cf682aa3fa9f0a0a68ae2d0f89b25376519f0883e495

  • SHA512

    1c9e8a129bf0a634582343f14283d5bf152adc58f51230bf288482f49c5605c62b320ae1577571faf039a2b6c070985c251fa0f4a804e1dc98e287f087273498

Score
10/10
dridex10444botnetloader

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

23.246.204.126:443

151.106.39.36:8116

103.124.144.123:6891

172.105.78.60:4664
rc4.plain
rc4.plain

Targets

    • Target

      wisr1qas.jpg

    • Size

      476KB

    • MD5

      f7703084b13482c646f3851e18d8951a

    • SHA1

      939ff0c3db869fa5656b6905f824fdb69050e43c

    • SHA256

      b98be8d2e7d160dacbd6cf682aa3fa9f0a0a68ae2d0f89b25376519f0883e495

    • SHA512

      1c9e8a129bf0a634582343f14283d5bf152adc58f51230bf288482f49c5605c62b320ae1577571faf039a2b6c070985c251fa0f4a804e1dc98e287f087273498

    Score
    10/10
    dridex10444botnetloader

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

      botnetloader
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks