General

  • Target

    048fe280a5f3a1fa3bede5c74bafa13a0f3b161fa21599568cdb53ae41d51df0

  • Size

    510KB

  • Sample

    241219-yfad8sxrcz

  • MD5

    2ff0af0aa54f06c43c7a586a50ed7a0b

  • SHA1

    e39dfac475cbc43459269f4ecb72dfb97903fb24

  • SHA256

    048fe280a5f3a1fa3bede5c74bafa13a0f3b161fa21599568cdb53ae41d51df0

  • SHA512

    f4c9f3c99af17bc182da26e61288193d127a3f0c08b39c7d5e28d57d7f0b80b24f67ed527b69e4cc06056e2bb618a73becf2aaef8df37e993a2f629369e88bd6

  • SSDEEP

    6144:jwUfyIU4F2yz2EwlwUsViffD//XiCM0pS/zzRYtJtxs5KfAnq1goVnJY0dK8/K3B:UUaIU47PCwWrpS76J7sEoODIv3waMu

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

217.20.166.177:443

54.38.143.246:691

92.38.128.47:3389

rc4.plain
rc4.plain

Targets

    • Target

      048fe280a5f3a1fa3bede5c74bafa13a0f3b161fa21599568cdb53ae41d51df0

    • Size

      510KB

    • MD5

      2ff0af0aa54f06c43c7a586a50ed7a0b

    • SHA1

      e39dfac475cbc43459269f4ecb72dfb97903fb24

    • SHA256

      048fe280a5f3a1fa3bede5c74bafa13a0f3b161fa21599568cdb53ae41d51df0

    • SHA512

      f4c9f3c99af17bc182da26e61288193d127a3f0c08b39c7d5e28d57d7f0b80b24f67ed527b69e4cc06056e2bb618a73becf2aaef8df37e993a2f629369e88bd6

    • SSDEEP

      6144:jwUfyIU4F2yz2EwlwUsViffD//XiCM0pS/zzRYtJtxs5KfAnq1goVnJY0dK8/K3B:UUaIU47PCwWrpS76J7sEoODIv3waMu

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader 'dmod' strings

      Detects 'dmod' strings in Dridex loader.

MITRE ATT&CK Enterprise v15

Tasks