General

  • Target

    8973aa95c59a125b4429ec0d57dc128ccfd6f1c8b5f5b9e649cbf31a1555b19f

  • Size

    177KB

  • Sample

    241221-tqz1essqbl

  • MD5

    bf279dfc6e692f2e7cd5c56f6d46a86e

  • SHA1

    879136bbdfc5f608a00d83fa1238899faf0501c7

  • SHA256

    8973aa95c59a125b4429ec0d57dc128ccfd6f1c8b5f5b9e649cbf31a1555b19f

  • SHA512

    39223bffaa13ccb4ca8fef4a37740bc9173db00cb9c7462fd58558ada29df290b255ee7f9390e310dc9510e352fd1f8c53e8c91efa1c4cdbb016016f83fe1aec

  • SSDEEP

    3072:kuCmyBVtWxZCOCA4Hpl1tv18FTETA8ocya/OyoSJPAacbnid8DOHPJ+HJ:4zWxkOP4p2EesvcDi6DOHPJ

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

144.76.1.150:443

50.249.212.98:23399

104.168.154.79:5007

rc4.plain
rc4.plain

Targets

    • Target

      8973aa95c59a125b4429ec0d57dc128ccfd6f1c8b5f5b9e649cbf31a1555b19f

    • Size

      177KB

    • MD5

      bf279dfc6e692f2e7cd5c56f6d46a86e

    • SHA1

      879136bbdfc5f608a00d83fa1238899faf0501c7

    • SHA256

      8973aa95c59a125b4429ec0d57dc128ccfd6f1c8b5f5b9e649cbf31a1555b19f

    • SHA512

      39223bffaa13ccb4ca8fef4a37740bc9173db00cb9c7462fd58558ada29df290b255ee7f9390e310dc9510e352fd1f8c53e8c91efa1c4cdbb016016f83fe1aec

    • SSDEEP

      3072:kuCmyBVtWxZCOCA4Hpl1tv18FTETA8ocya/OyoSJPAacbnid8DOHPJ+HJ:4zWxkOP4p2EesvcDi6DOHPJ

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

MITRE ATT&CK Enterprise v15

Tasks