Resubmissions

13-05-2022 06:06

220513-gt5nvscfh6 10

13-05-2022 05:59

220513-gpz8ksfgbk 10

30-04-2021 05:04

210430-gqhdv8yacs 10

General

  • Target

    723de23d_by_Libranalysis

  • Size

    240KB

  • Sample

    220513-gpz8ksfgbk

  • MD5

    723de23df8c1e63e0432742b29b7e68d

  • SHA1

    9147ebd492d30c8634f06f8f8a805979a9312457

  • SHA256

    dafba9329c6a80b19dae1e3ccf65b1a176b2ef9e7d085feabf75822d59d17515

  • SHA512

    513a59c5a71715efbceffb417fb002ee29abd5a1af2028682ba8d41436c366a772a10e4a8012dcadd7f76ed4c40e04a09a435487871dd1b712f6d5c5cd33ce43

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

77.220.64.135:443

153.126.165.175:6601

210.65.244.183:8443

rc4.plain
rc4.plain

Targets

    • Target

      874c2077d9d9036ef76bd36bb444677a1d2a6e6aaa7f0dfdd91bd2e0972b84c6

    • Size

      1.2MB

    • MD5

      395d57a0fd2e21c3f5d606c9efec83cc

    • SHA1

      98747a4cbd9984170b1b0c9d7a8be269903726af

    • SHA256

      874c2077d9d9036ef76bd36bb444677a1d2a6e6aaa7f0dfdd91bd2e0972b84c6

    • SHA512

      7abdbcb068fcb7a2f0eda3ea8d964f8a7640e8a5bb9b306552053becec13b261c9b4740eeb6936a2e3a18b307fa53c588d8e9f8d7b91e4cdf57b95588a5b4498

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Tasks