Overview

overview

10

Static

static

3

00c003a0a7...ed.dll

windows7-x64

10

00c003a0a7...ed.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    00c003a0a74b038d023c30e4d4f49252c054e3e367b6a6dbfc721081d75592ed

  • Size

    162KB

  • Sample

    240605-qe4yfsgc51

  • MD5

    f017a97c8116075e5c0a0fa136205e8f

  • SHA1

    e2115c605425c1c0b1eb638fbdeec9e7ac3c6c5e

  • SHA256

    00c003a0a74b038d023c30e4d4f49252c054e3e367b6a6dbfc721081d75592ed

  • SHA512

    afd1d68e86d4893c068249692e99655ba875afefff0dbc6cac1a23da8ed8624944a16dd58d9f5ac7ccb88f8b7dd5f7e34583b82d3e98a1af3081814c05a0bfd0

  • SSDEEP

    3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p

Score
10/10
dridex40112botnetevasionloadertrojan

Malware Config

Extracted

Family

dridex

Botnet

40112

C2

107.172.227.10:443

172.93.133.123:2303

108.168.61.147:8172
rc4.plain
rc4.plain

Targets

    • Target

      00c003a0a74b038d023c30e4d4f49252c054e3e367b6a6dbfc721081d75592ed

    • Size

      162KB

    • MD5

      f017a97c8116075e5c0a0fa136205e8f

    • SHA1

      e2115c605425c1c0b1eb638fbdeec9e7ac3c6c5e

    • SHA256

      00c003a0a74b038d023c30e4d4f49252c054e3e367b6a6dbfc721081d75592ed

    • SHA512

      afd1d68e86d4893c068249692e99655ba875afefff0dbc6cac1a23da8ed8624944a16dd58d9f5ac7ccb88f8b7dd5f7e34583b82d3e98a1af3081814c05a0bfd0

    • SSDEEP

      3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p

    Score
    10/10
    dridex40112botnetevasionloadertrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

      botnetloader

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks