523889c41d9c65281f118d3f4c26c708.exe

General
Target

523889c41d9c65281f118d3f4c26c708.exe

Size

1MB

Sample

210827-n4z6bw8f6n

Score
10 /10
MD5

523889c41d9c65281f118d3f4c26c708

SHA1

f33305576a93f1d66896bd2a1a3b0d3eb85d9a40

SHA256

0ccc1ea2dc07c5d01ffbcdf63a94f5bf52fac32ab3d9075204cd07b2d0455126

SHA512

20e5da18708129645ef053b392d50cf8e30781441c402870d3aad9cb9a6b72ea471d39d5fa4c905fef15f1a95bfc37b458ace6ec63305ab10b7b8a9b5dcd246e

Malware Config

Extracted

Family dridex
Botnet 10111
C2

5.135.167.231:8443

212.53.160.143:10172

51.75.162.188:6225

rc4.plain
rc4.plain
Targets
Target

523889c41d9c65281f118d3f4c26c708.exe

MD5

523889c41d9c65281f118d3f4c26c708

Filesize

1MB

Score
10 /10
SHA1

f33305576a93f1d66896bd2a1a3b0d3eb85d9a40

SHA256

0ccc1ea2dc07c5d01ffbcdf63a94f5bf52fac32ab3d9075204cd07b2d0455126

SHA512

20e5da18708129645ef053b392d50cf8e30781441c402870d3aad9cb9a6b72ea471d39d5fa4c905fef15f1a95bfc37b458ace6ec63305ab10b7b8a9b5dcd246e

Tags

Signatures

  • Dridex

    Description

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    Tags

  • Checks installed software on the system

    Description

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    Tags

    TTPs

    Query Registry
  • Checks whether UAC is enabled

    Tags

    TTPs

    System Information Discovery

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation