General
-
Target
ebfrx57.dll
-
Size
539KB
-
Sample
201118-a38rvks1v2
-
MD5
99b10941dd60a6d6e9833ddd7dd8bf87
-
SHA1
819f39375b87402693f0d0e5f3434c5747234227
-
SHA256
1fd19222df72ea875613e81a37e94c30a25cb2d69d857159ee1d7fdfc8848348
-
SHA512
c9474466bb4ed8ff2661c26f407d9f7a59b9820f6e46181bbf76dd4fdd60d489626077c468fac8002941b788131e11c006cb78b541151ea70eda60d0e009b58d
Behavioral task
behavioral1
Sample
ebfrx57.dll
Resource
win7v20201028
Malware Config
Extracted
dridex
10444
162.241.44.26:9443
192.232.229.53:4443
77.220.64.34:443
193.90.12.121:3098
Targets
-
-
Target
ebfrx57.dll
-
Size
539KB
-
MD5
99b10941dd60a6d6e9833ddd7dd8bf87
-
SHA1
819f39375b87402693f0d0e5f3434c5747234227
-
SHA256
1fd19222df72ea875613e81a37e94c30a25cb2d69d857159ee1d7fdfc8848348
-
SHA512
c9474466bb4ed8ff2661c26f407d9f7a59b9820f6e46181bbf76dd4fdd60d489626077c468fac8002941b788131e11c006cb78b541151ea70eda60d0e009b58d
-
Blocklisted process makes network request
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-