General

  • Target

    a2c869a9287b07e8601a847b681d6080.exe

  • Size

    650KB

  • Sample

    210827-jxhxeh468x

  • MD5

    a2c869a9287b07e8601a847b681d6080

  • SHA1

    ebe0973e63917232f8608839f295c32cb209f817

  • SHA256

    6878b5e139b743a2a6c9cc23c3837d4e935cdf8d4283a33c56358b9408c6960a

  • SHA512

    e7ad2089ff2dd59729ed31d5299e5789cd06e32452c74e6730b76ed3a6c6e61299d0f03d675b8fe1f94b978854addb19bbdc5244faf459869a4a6acc95612e36

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

192.99.150.39:7443

46.101.182.168:10172

216.120.236.127:9043

rc4.plain
rc4.plain

Targets

    • Target

      a2c869a9287b07e8601a847b681d6080.exe

    • Size

      650KB

    • MD5

      a2c869a9287b07e8601a847b681d6080

    • SHA1

      ebe0973e63917232f8608839f295c32cb209f817

    • SHA256

      6878b5e139b743a2a6c9cc23c3837d4e935cdf8d4283a33c56358b9408c6960a

    • SHA512

      e7ad2089ff2dd59729ed31d5299e5789cd06e32452c74e6730b76ed3a6c6e61299d0f03d675b8fe1f94b978854addb19bbdc5244faf459869a4a6acc95612e36

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Tasks