Overview

overview

10

Static

static

3

Report-24S...20.scr

windows7-x64

10

Report-24S...20.scr

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    a3b18c467e1d9e43ba85a2ccdcfaf83d_JaffaCakes118
  • Size 591KB
  • Sample240817-xcvqbstdnl
  • SHA256 3c08465a1453b7ae0a91858ca433f0670e11e769daaff2dd43cac6edc3fc0479
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
dridex10555botnetdiscoveryevasion

Malware Config

Extracted

Family

  • dridex

Botnet

  • 10555

C2

  • 151.236.219.181:443

  • 142.4.6.57:14043

  • 162.144.127.197:3786

  • 103.40.116.68:5443

rc4.plain
rc4.plain

Targets

    • Target
      Report-24Sept.2020.scr
    • Size 734KB
    • SHA256 fad001d463e892e7844040cabdcfa8f8431c07e7ef1ffd76ffbd190f49d7693d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    dridex10555botnetdiscoveryevasion

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks