Overview

overview

10

Static

static

9

5b478c9721...ab.exe

windows7_x64

10

5b478c9721...ab.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5b478c97213c493e88ad38fa017db4ab.exe

  • Size

    1.0MB

  • Sample

    210704-xkra7g73fx

  • MD5

    5b478c97213c493e88ad38fa017db4ab

  • SHA1

    219474316e41df563322149b653cb160c0d49167

  • SHA256

    fe9f82e1175d3a18ca3e0244318d2e485ed7a51b475bc366ba768af62a83d875

  • SHA512

    58e8fb42a92620a1ec67169d5214409eec3b873634a3fe0c98889ed25401ab0cc97a0bcec16d31eefc1b8706cfc9e2ecd8271c5932f0c861f1f10bd57b62d16f

Score
10/10
dridex10111botnetcryptonediscoveryevasionpackertrojan

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

104.168.155.129:443

142.4.219.173:4664

176.31.117.84:9443
rc4.plain
rc4.plain

Targets

    • Target

      5b478c97213c493e88ad38fa017db4ab.exe

    • Size

      1.0MB

    • MD5

      5b478c97213c493e88ad38fa017db4ab

    • SHA1

      219474316e41df563322149b653cb160c0d49167

    • SHA256

      fe9f82e1175d3a18ca3e0244318d2e485ed7a51b475bc366ba768af62a83d875

    • SHA512

      58e8fb42a92620a1ec67169d5214409eec3b873634a3fe0c98889ed25401ab0cc97a0bcec16d31eefc1b8706cfc9e2ecd8271c5932f0c861f1f10bd57b62d16f

    Score
    10/10
    dridex10111botnetdiscoveryevasiontrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks