Overview

overview

10

Static

static

3

Ci9suwhy.dll

windows7-x64

10

Ci9suwhy.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_461ace3e03494f901d98088f2c42a50bcb9158b7827a94839a0f092376522b3e

  • Size

    120KB

  • Sample

    241230-3k5hdsxjat

  • MD5

    a519c97fa1de038732656b3f026af938

  • SHA1

    2a28e3dae4709f144e54a8d62794eb8c8479c79d

  • SHA256

    461ace3e03494f901d98088f2c42a50bcb9158b7827a94839a0f092376522b3e

  • SHA512

    376db4b7453fc6329973aaa46501900794fcc5a6b61fdeb4843d5ead18b3415b3e37e364bd2ee13cff891c64782972c19f948fad9def6a0af3db0146d3ce6275

  • SSDEEP

    1536:ppyrIIiGiEfaOKSYQJcY1rFY/SKf52geqbbtXIAtRubSKEo0z0QY/2Aufke9D/kq:p+IpkfoShS5BJ3tXIT+G0YQDAwke9rh

Score
10/10
dridex22202botnetdiscoveryloader

Malware Config

Extracted

Family

dridex

Botnet

22202

C2

80.241.218.90:443

103.161.172.109:13786

87.98.128.76:5723
rc4.plain
rc4.plain

Targets

    • Target

      Ci9suwhy.php

    • Size

      184KB

    • MD5

      68f6f10e614e60ae4d344fbfb82b53af

    • SHA1

      23e791ca2dd0aa531c48ce0ddf19ebc79dba588b

    • SHA256

      c9d2468f2dcf405949c9b2aa9429058e808a79e65ea89058cab9c8b2dbe86bac

    • SHA512

      d39b974da5ff2f0d40b08b163a1419e97886a1ebd3ed28dc652dedec4217fbd5a69477f3b2dc2bc35d42b576a0a546005be97d20fbf75ce04078ff2be62ee1dd

    • SSDEEP

      3072:cY2KSjqHseIjde9BDjklQ+wtfFI+Jt5UQmNtNmdyoAgh2//R:cY2ZM+M0lQtdqkdyoaH

    Score
    10/10
    dridex22202botnetdiscoveryloader

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex family

      dridex

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

      botnetloader
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks