DllUnregisterServer
Behavioral task
behavioral1
Sample
Dridex_ba1c35ea63d1d791499e005f533dc2dba4f274fe95c9269dfbb3da95e66028af.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Dridex_ba1c35ea63d1d791499e005f533dc2dba4f274fe95c9269dfbb3da95e66028af.exe
Resource
win10v2004-20220414-en
General
-
Target
Dridex_ba1c35ea63d1d791499e005f533dc2dba4f274fe95c9269dfbb3da95e66028af.zip
-
Size
86KB
-
MD5
5eca2635ecf0e28233e81364a765de40
-
SHA1
081fd23ad2cf7698efae7c796aec0f616f38cf1b
-
SHA256
d1ea1b02bcb1470189de830926a6ae71937ee1cee9d40d270cc9cebef0065e28
-
SHA512
47d3baa916e9af66e906690f2c29dede5fe5fb71eddd3056c3e1754b2e8861db16b55880f598995e75b0396a0e2bc332459a9c71565e6bc63c3a71b84779fb91
-
SSDEEP
1536:xKlVFlPxKHVmp9aRY4nPFTo5lsMVsSo/mIFLgPHGsgFzaZ5/HhhCfjdfzz3Q9y:olVFlWV28u4nPZ0nVVo+IFdsgF+Z5Bhw
Malware Config
Extracted
dridex
40400
132.255.244.130:443
111.67.77.202:3389
198.50.236.57:443
45.122.223.13:8443
Signatures
-
Dridex family
Files
-
Dridex_ba1c35ea63d1d791499e005f533dc2dba4f274fe95c9269dfbb3da95e66028af.zip.zip
Password: test1234
-
Dridex_ba1c35ea63d1d791499e005f533dc2dba4f274fe95c9269dfbb3da95e66028af.bin.exe windows x86
Password: test1234
eb76140cc31cd615e218e51dbcad0a7b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeConsole
ExitProcess
GetComputerNameW
AddVectoredExceptionHandler
OutputDebugStringW
Sleep
advapi32
GetUserNameW
Exports
Exports
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 48KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ