General

  • Target

    639c1e0ebd239824b033591f8809a3c8e4e92bc42fb456514b10b8ee7089c5e6

  • Size

    184KB

  • Sample

    240926-1yqkaatajh

  • MD5

    e2fe0ab19333c1e40a495c63d404c691

  • SHA1

    ed4c4973a9d83d9b60b3f521baa3699581f780f4

  • SHA256

    639c1e0ebd239824b033591f8809a3c8e4e92bc42fb456514b10b8ee7089c5e6

  • SHA512

    a06e9fcf7f519c62e7a87b573beddd5fff8d7221bd36d669d02b3fd9beb24b4b8ae4d50b8f0fe1dec8cf0db392d6885f53675d00e2c5dbcd3cc59fdcfef1aa99

  • SSDEEP

    3072:xgkQz1PuOprc+kq6VNOe3qbarVEpZlcbBacS9nOdgGdA4l:IPFkq6zOe5ilSanOpd

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

103.75.201.2:443

158.223.1.108:6225

165.22.28.242:4664

rc4.plain
rc4.plain

Targets

    • Target

      639c1e0ebd239824b033591f8809a3c8e4e92bc42fb456514b10b8ee7089c5e6

    • Size

      184KB

    • MD5

      e2fe0ab19333c1e40a495c63d404c691

    • SHA1

      ed4c4973a9d83d9b60b3f521baa3699581f780f4

    • SHA256

      639c1e0ebd239824b033591f8809a3c8e4e92bc42fb456514b10b8ee7089c5e6

    • SHA512

      a06e9fcf7f519c62e7a87b573beddd5fff8d7221bd36d669d02b3fd9beb24b4b8ae4d50b8f0fe1dec8cf0db392d6885f53675d00e2c5dbcd3cc59fdcfef1aa99

    • SSDEEP

      3072:xgkQz1PuOprc+kq6VNOe3qbarVEpZlcbBacS9nOdgGdA4l:IPFkq6zOe5ilSanOpd

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks