General

  • Target

    f8ff1e1760041cfcc2516d2d9729eec0N

  • Size

    210KB

  • Sample

    240913-2qmdbstfng

  • MD5

    f8ff1e1760041cfcc2516d2d9729eec0

  • SHA1

    c025c58fc498f984d8053c5718737037c8b9b0a9

  • SHA256

    6e51f9a0d68d559ad556777e48b41db597a4da5cfa57f1a907bbcd19ebe0a4b3

  • SHA512

    53cb12adf4651589aaf6420895abcf9de2502a42151c50dd0acfa78b09e1132cc98246bb4d74a5383fa48a68b5751f00a5501c0184b7bca4faf57668f081b8e0

  • SSDEEP

    3072:s9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNAX:s9Y21i/zGmsMm1vSDWN0

Malware Config

Extracted

Family

dridex

Botnet

111

C2

77.220.64.137:443

66.228.134.180:6601

199.204.214.26:7073

rc4.plain
rc4.plain

Targets

    • Target

      f8ff1e1760041cfcc2516d2d9729eec0N

    • Size

      210KB

    • MD5

      f8ff1e1760041cfcc2516d2d9729eec0

    • SHA1

      c025c58fc498f984d8053c5718737037c8b9b0a9

    • SHA256

      6e51f9a0d68d559ad556777e48b41db597a4da5cfa57f1a907bbcd19ebe0a4b3

    • SHA512

      53cb12adf4651589aaf6420895abcf9de2502a42151c50dd0acfa78b09e1132cc98246bb4d74a5383fa48a68b5751f00a5501c0184b7bca4faf57668f081b8e0

    • SSDEEP

      3072:s9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNAX:s9Y21i/zGmsMm1vSDWN0

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks