General

  • Target

    a033824a885207df6a9cf3d33fb0d7b113af10e943c9a6c8856448a374d191f8

  • Size

    663KB

  • Sample

    250321-zhdecayygx

  • MD5

    16d809757e4fe9d7b603efb0508a6242

  • SHA1

    ccc93c678580888a4da405b61a1710297a1c3448

  • SHA256

    a033824a885207df6a9cf3d33fb0d7b113af10e943c9a6c8856448a374d191f8

  • SHA512

    b2ebbafba80d94fb729ca5c3eb1f0c5c57cbb414358e181ac804e586bab3a385af49d0e8d9e3e7866c8944000fe1a9c00a5ab6fc5764d18005f5e4b631e32504

  • SSDEEP

    12288:AHcRey4pHcRey4pHcRey4vyqCIkykwW1yaL7TOuCc:ACqCqCj1bykwW11TOnc

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

5.9.178.143:443

185.230.161.62:3389

2.58.16.89:8443

rc4.plain
rc4.plain

Targets

    • Target

      a033824a885207df6a9cf3d33fb0d7b113af10e943c9a6c8856448a374d191f8

    • Size

      663KB

    • MD5

      16d809757e4fe9d7b603efb0508a6242

    • SHA1

      ccc93c678580888a4da405b61a1710297a1c3448

    • SHA256

      a033824a885207df6a9cf3d33fb0d7b113af10e943c9a6c8856448a374d191f8

    • SHA512

      b2ebbafba80d94fb729ca5c3eb1f0c5c57cbb414358e181ac804e586bab3a385af49d0e8d9e3e7866c8944000fe1a9c00a5ab6fc5764d18005f5e4b631e32504

    • SSDEEP

      12288:AHcRey4pHcRey4pHcRey4vyqCIkykwW1yaL7TOuCc:ACqCqCj1bykwW11TOnc

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader 'dmod' strings

      Detects 'dmod' strings in Dridex loader.

MITRE ATT&CK Enterprise v15

Tasks