Overview

overview

10

Static

static

Amazon_eGi...14.scr

windows7_x64

10

Amazon_eGi...14.scr

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Amazon_eGift-Card_579366314.scr

  • Size

    905KB

  • Sample

    201126-r8q2v9e7s6

  • MD5

    e3c73316a5a270a82f24e56ec0f62e0e

  • SHA1

    a8adc02637c62262e02f0097222cda0cd2aef013

  • SHA256

    ee492eda053d19e082cd88acef8825e8dfd4616d51689e2e9667f5ed9035b1df

  • SHA512

    b5079ed75843810c30d8c9e947917f9968f3930a7a7ca9b70f0ca22804aa2b29dbeb57c0eee18b94376817949b793ba74a64813fcd52a9e8f30660e4833ea6c5

Score
10/10
dridex10555botnetevasionloaderransomware

Malware Config

Extracted

Family

dridex

Botnet

10555

C2

194.225.58.216:443

178.254.40.132:691

216.172.165.70:3889

198.57.200.100:3786
rc4.plain
rc4.plain

Targets

    • Target

      Amazon_eGift-Card_579366314.scr

    • Size

      905KB

    • MD5

      e3c73316a5a270a82f24e56ec0f62e0e

    • SHA1

      a8adc02637c62262e02f0097222cda0cd2aef013

    • SHA256

      ee492eda053d19e082cd88acef8825e8dfd4616d51689e2e9667f5ed9035b1df

    • SHA512

      b5079ed75843810c30d8c9e947917f9968f3930a7a7ca9b70f0ca22804aa2b29dbeb57c0eee18b94376817949b793ba74a64813fcd52a9e8f30660e4833ea6c5

    Score
    10/10
    dridex10555botnetevasionloaderransomware

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

      botnetloader

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Loads dropped DLL

    • Enumerates physical storage devices

      Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2
T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2
T1158

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks