General

  • Target

    2cb2455895375f1f913e07c44f861853eb5f03352c71e230502f61057788e37c

  • Size

    608KB

  • Sample

    211014-gaey4agbdr

  • MD5

    a88e7ff524769228ecbedd99cbcae881

  • SHA1

    f897b3d1dc099e2ebd490e5e62ca6fdd35c84607

  • SHA256

    2cb2455895375f1f913e07c44f861853eb5f03352c71e230502f61057788e37c

  • SHA512

    eec245daa7a38a98ee1abcab006a1fb60af0d2f2299c76705d91ad268de76a7915342b07a57c20bb16e98dc9408abb4c013be6a412c6bc3f3ae7e42f603c5736

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

174.128.245.202:443

51.83.3.52:13786

69.64.50.41:6602

rc4.plain
rc4.plain

Targets

    • Target

      2cb2455895375f1f913e07c44f861853eb5f03352c71e230502f61057788e37c

    • Size

      608KB

    • MD5

      a88e7ff524769228ecbedd99cbcae881

    • SHA1

      f897b3d1dc099e2ebd490e5e62ca6fdd35c84607

    • SHA256

      2cb2455895375f1f913e07c44f861853eb5f03352c71e230502f61057788e37c

    • SHA512

      eec245daa7a38a98ee1abcab006a1fb60af0d2f2299c76705d91ad268de76a7915342b07a57c20bb16e98dc9408abb4c013be6a412c6bc3f3ae7e42f603c5736

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Tasks