Overview

overview

10

Static

static

9

a645843910...97.exe

windows7_x64

10

a645843910...97.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a645843910112f9a5ae386ca87c03e97.exe

  • Size

    1.0MB

  • Sample

    210628-fz75ey49n2

  • MD5

    a645843910112f9a5ae386ca87c03e97

  • SHA1

    3f047cb47258dfdcea41cd443c9686cf024667ba

  • SHA256

    af158f524186d5bb8f0cd61679c2c0b7a874261ae23251c45b0054789e60156e

  • SHA512

    4c8447e46ecb3d3b4e06721d3288d47b35d6674334d4e2c22c562c1a4d5b65392743a9eb183dcf95f3917b754b693a152abfc2946630262f8b95ebbd2beca810

Score
10/10
dridex10111botnetcryptonediscoveryevasionpackertrojan

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

115.68.220.48:443

103.42.57.18:5007

95.111.235.8:13786
rc4.plain
rc4.plain

Targets

    • Target

      a645843910112f9a5ae386ca87c03e97.exe

    • Size

      1.0MB

    • MD5

      a645843910112f9a5ae386ca87c03e97

    • SHA1

      3f047cb47258dfdcea41cd443c9686cf024667ba

    • SHA256

      af158f524186d5bb8f0cd61679c2c0b7a874261ae23251c45b0054789e60156e

    • SHA512

      4c8447e46ecb3d3b4e06721d3288d47b35d6674334d4e2c22c562c1a4d5b65392743a9eb183dcf95f3917b754b693a152abfc2946630262f8b95ebbd2beca810

    Score
    10/10
    dridex10111botnetdiscoveryevasiontrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks