General

  • Target

    f9ddc6011a0e5457822ff04ded5ad90d63bfef3cecc8d85f7647a6bf19b467bb

  • Size

    696KB

  • Sample

    240912-p6ebfawbmm

  • MD5

    d32d08ad1b4f84968737715e70b94023

  • SHA1

    45d575115133680a73ec2361aa44eb6af98abce0

  • SHA256

    f9ddc6011a0e5457822ff04ded5ad90d63bfef3cecc8d85f7647a6bf19b467bb

  • SHA512

    5572083a9b8b847d750929cfaef03ea598115081266d37e23633468999f63f64bf6c88ceda76ae4503ff9ae396f7315bb338d74a1e3907d311d2fb401697f5e7

  • SSDEEP

    6144:s9Y21i/zGmsMm1vSDWNc0Llq/PcUtgrvBpctWQQ:s6cUGvxNo0LkPcUtgrvXctWD

Malware Config

Extracted

Family

dridex

Botnet

111

C2

77.220.64.137:443

66.228.134.180:6601

199.204.214.26:7073

rc4.plain
rc4.plain

Targets

    • Target

      f9ddc6011a0e5457822ff04ded5ad90d63bfef3cecc8d85f7647a6bf19b467bb

    • Size

      696KB

    • MD5

      d32d08ad1b4f84968737715e70b94023

    • SHA1

      45d575115133680a73ec2361aa44eb6af98abce0

    • SHA256

      f9ddc6011a0e5457822ff04ded5ad90d63bfef3cecc8d85f7647a6bf19b467bb

    • SHA512

      5572083a9b8b847d750929cfaef03ea598115081266d37e23633468999f63f64bf6c88ceda76ae4503ff9ae396f7315bb338d74a1e3907d311d2fb401697f5e7

    • SSDEEP

      6144:s9Y21i/zGmsMm1vSDWNc0Llq/PcUtgrvBpctWQQ:s6cUGvxNo0LkPcUtgrvXctWD

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks