Overview

overview

10

Static

static

a66dbdea71...20.exe

windows7_x64

10

a66dbdea71...20.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a66dbdea71c220e57325e20d01516820.exe

  • Size

    1.1MB

  • Sample

    210801-ml2daddnlx

  • MD5

    a66dbdea71c220e57325e20d01516820

  • SHA1

    c72bfbfb631123ff26c4278ca4f059b8185d46d8

  • SHA256

    851c23c1e7511cae9134da4086116a84a8c28405a0ba05f1a9654a518e2cd64d

  • SHA512

    d9d46a0c0b089c8f221cd103dff598b7c5056559e987ca69de17e63a6da34e514ba5f93d514b7205b698d8988068f69e63aa91dad4f5e1e270289b8f80cd5124

Score
10/10
dridex10111botnetdiscoveryevasiontrojan

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

103.109.247.13:10443

116.203.25.236:8443

103.253.107.156:7443
rc4.plain
rc4.plain

Targets

    • Target

      a66dbdea71c220e57325e20d01516820.exe

    • Size

      1.1MB

    • MD5

      a66dbdea71c220e57325e20d01516820

    • SHA1

      c72bfbfb631123ff26c4278ca4f059b8185d46d8

    • SHA256

      851c23c1e7511cae9134da4086116a84a8c28405a0ba05f1a9654a518e2cd64d

    • SHA512

      d9d46a0c0b089c8f221cd103dff598b7c5056559e987ca69de17e63a6da34e514ba5f93d514b7205b698d8988068f69e63aa91dad4f5e1e270289b8f80cd5124

    Score
    10/10
    dridex10111botnetdiscoveryevasiontrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks