General

  • Target

    c650619452d359a47e88fb1040aeef84ee338e849e7b2cfd0870749c78719e45

  • Size

    885KB

  • Sample

    250325-dqbptstly7

  • MD5

    3d4cb4d06a3d8e334f751ff1013bdd5e

  • SHA1

    cb46898b2d08705a215e2e2a3521c1b20e0860be

  • SHA256

    c650619452d359a47e88fb1040aeef84ee338e849e7b2cfd0870749c78719e45

  • SHA512

    4d2bb0a3b4b8d8f1ec593d81e6820d77750721629bbc052ef1e7a0b53487bdcda4087e3acba7dec8b73372e2c06c44978fefe4f811a5d9adc5b3c296f662e555

  • SSDEEP

    24576:dtfEiHP1psQFAFMnnUNCQEKZm+jWodEEoB1l:rfEiv1JFAkU8N1l

Malware Config

Extracted

Family

dridex

Botnet

40112

C2

107.172.227.10:443

172.93.133.123:2303

108.168.61.147:8172

rc4.plain
rc4.plain

Targets

    • Target

      c650619452d359a47e88fb1040aeef84ee338e849e7b2cfd0870749c78719e45

    • Size

      885KB

    • MD5

      3d4cb4d06a3d8e334f751ff1013bdd5e

    • SHA1

      cb46898b2d08705a215e2e2a3521c1b20e0860be

    • SHA256

      c650619452d359a47e88fb1040aeef84ee338e849e7b2cfd0870749c78719e45

    • SHA512

      4d2bb0a3b4b8d8f1ec593d81e6820d77750721629bbc052ef1e7a0b53487bdcda4087e3acba7dec8b73372e2c06c44978fefe4f811a5d9adc5b3c296f662e555

    • SSDEEP

      24576:dtfEiHP1psQFAFMnnUNCQEKZm+jWodEEoB1l:rfEiv1JFAkU8N1l

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks