Overview

overview

10

Static

static

ac41b32112...bf.exe

windows7_x64

10

ac41b32112...bf.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ac41b32112843274e4ffae34e11867bf.exe

  • Size

    379KB

  • Sample

    211011-p1rdtahbf4

  • MD5

    ac41b32112843274e4ffae34e11867bf

  • SHA1

    11a692980e75cdae8dc704774b48d7248000e6ab

  • SHA256

    b25e2a9b4e658c038dacab83460dfaa656623cbec82b4e276cc7e3722f71089d

  • SHA512

    423498634fa7846ece448318adc5d6a30984c2e00451db0960b9d18c86fc7e85fd47d2fe030dcb9ec9289a5d368df930b0c8f1b1798dc0cc5c71b122bed5685a

Score
10/10
dridex10111botnetdiscoveryevasiontrojan

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

212.112.86.37:9676

184.168.147.173:6225

72.52.96.202:8194
rc4.plain
rc4.plain

Targets

    • Target

      ac41b32112843274e4ffae34e11867bf.exe

    • Size

      379KB

    • MD5

      ac41b32112843274e4ffae34e11867bf

    • SHA1

      11a692980e75cdae8dc704774b48d7248000e6ab

    • SHA256

      b25e2a9b4e658c038dacab83460dfaa656623cbec82b4e276cc7e3722f71089d

    • SHA512

      423498634fa7846ece448318adc5d6a30984c2e00451db0960b9d18c86fc7e85fd47d2fe030dcb9ec9289a5d368df930b0c8f1b1798dc0cc5c71b122bed5685a

    Score
    10/10
    dridex10111botnetdiscoveryevasiontrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks