General

  • Target

    a7e6831062eefae7a8e8f3546b62b052.exe

  • Size

    1.1MB

  • Sample

    210917-wjkm9sahan

  • MD5

    a7e6831062eefae7a8e8f3546b62b052

  • SHA1

    cf2c886b040f33e1eda84d9cdab147c8b859b037

  • SHA256

    437275776c30ea1da5305f31a1d9a07567b2df3c6f41229782afdcf46343cbed

  • SHA512

    653e39eedc4ce52f9abae553519f0078539813f5e2f254969bcf1d3570828aa8ae6996d8960c7ac920fe981b6d2e93cd3baaba4a17481024535df148369352c2

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

159.65.3.147:6225

194.141.47.9:7443

5.199.174.90:9043

rc4.plain
rc4.plain

Targets

    • Target

      a7e6831062eefae7a8e8f3546b62b052.exe

    • Size

      1.1MB

    • MD5

      a7e6831062eefae7a8e8f3546b62b052

    • SHA1

      cf2c886b040f33e1eda84d9cdab147c8b859b037

    • SHA256

      437275776c30ea1da5305f31a1d9a07567b2df3c6f41229782afdcf46343cbed

    • SHA512

      653e39eedc4ce52f9abae553519f0078539813f5e2f254969bcf1d3570828aa8ae6996d8960c7ac920fe981b6d2e93cd3baaba4a17481024535df148369352c2

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Tasks