Overview

overview

10

Static

static

3

16017353e6...fb.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16017353e67868fd3b785aa22db51efb.zip

  • Size

    114KB

  • Sample

    240707-jt7vbsxdjr

  • MD5

    2e783ea803ecbdda9fecaed1dae41b12

  • SHA1

    be9f1f7bf19295d724ca3796910e472a4b8f455d

  • SHA256

    fcb05de6caf64f74cd59a838ab359538bfe01fac17f3d037c06d6966a1f3ac10

  • SHA512

    4b0c5093aa2bdc37be711bedfe5c01d6837c3517b6a35be6deab540b9aed020c8a1736485226bf84ca5f1a6a1fb7ac10108ec1938fb7cc592278a1a7afe85cfb

  • SSDEEP

    3072:+8zmc1PXiZVgZEUii9YqHw5K2ng9VqSvPkP:tPyf2BF2qH8lgzqSvPkP

Score
10/10
dridex111botnetdiscoveryevasionloadertrojan

Malware Config

Extracted

Family

dridex

Botnet

111

C2

173.203.78.138:443

217.160.107.189:6601

77.220.64.150:5037
rc4.plain
rc4.plain

Targets

    • Target

      16017353e67868fd3b785aa22db51efb.dll

    • Size

      168KB

    • MD5

      16017353e67868fd3b785aa22db51efb

    • SHA1

      c85f9fca75fab04d74bbece3c180f318d55581dd

    • SHA256

      0c262ad9b5f041419149ee032e82abe2f7d06d263de648214c2a484436587d9a

    • SHA512

      ac6e5395d17aa97fd0fd2b7748c7525b139a339b9f86e14a714bc57d193af4c825c0584a446830a3fb51d68687be6f193412bab7d3c86efc5e32836454a56586

    • SSDEEP

      3072:p+rGFFRCMcyzAAykMPqIaXpZYnvf3gx4wblxLSoIm/H2QKGB2gC:p+rGFFlXAAcqj8nHgfOoIdG

    Score
    10/10
    dridex111botnetdiscoveryevasionloadertrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

      botnetloader

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks