forked from executemalware/Malware-IOCs
-
Notifications
You must be signed in to change notification settings - Fork 0
/
2021-10-13 Dridex IOCs
109 lines (97 loc) · 3.35 KB
/
2021-10-13 Dridex IOCs
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
THREAT ATTRIBUTION: DRIDEX
SENDER EMAILS
SUBJECTS
Invoice/Sales Receipt
Purchase Order Receipt
Sales Receipt
MALDOC FILE NAMES
Payment_Receipt ####.xls
Purchase_Order ####.xls
Sales_Receipt ####.xls
MALDOC FILE HASHES
e63deaea51f7cc2064ff808e11e1ad55
(all maldoc file hashes are the same)
PAYLOAD DOWNLOAD URLS
https://itadlearning.com
https://mas.hertzceylonsoftware.com
PAYLOAD FILE HASHES
ltqmcyjo
a289f26f09690ec48b1970204f8757c8
On the second run, I saw this:
wztxxfrr
9d6d2e3d5cd27fcec3a875c7cf8b7062
Then the third time:
tnlbmvxt
017ba8a27483a3ab3679c5161faf1d6a
DRIDEX C2
https://51.83.3.52:13786/
https://174.128.245.202/
https://69.64.50.41:6602/
EMAIL BODY
Your sales receipt is attached. Your credit card on file has been charged and this invoice is now paid.
Thank you for your business - we appreciate it very much.
Sincerely,
-------------------------
Sales Receipt Summary
---------------------------
Purchase Order # : 0292
Purchase Order Date: 10/13/2021
Total: $3,710.00
The complete version has been provided as an attachment to this email.
----------------------------------------------------------------------
MEMORY STRINGS
https://az667904.vo.msecnd.net/pub/Default/v2/dyntelconfig.json
http://www.burnsurface.ru