Overview

overview

10

Static

static

1

cd32a737fc...eb.exe

windows7-x64

10

cd32a737fc...eb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cd32a737fcba8198d43fed5a68348f983f7713f79574a710deb7759e5a1301eb.zip

  • Size

    131KB

  • Sample

    230310-m4qkksda62

  • MD5

    23be2ba8c9651381be362433ad00c499

  • SHA1

    9d21420b17e5bb881b1dc4f63173d41c84efbea7

  • SHA256

    3054638e32a53f28eec1eaae42b7656f148816684f2b24611e74c6350bb36121

  • SHA512

    de28e0b624672e724d5758d2c540aa8eb3af3a13b83021e0b4cca066399e60dc49455b3141434058c97ee50a859d1c32efb1942ecaa612a1c42ef0a24098cbda

  • SSDEEP

    3072:aEjX/mFs7c2ZNj1lccGKcfnbRmuQgBSRuoOcYG0qodhwLcPHBO:aEjX/m12ZpccGbnbwuQpOcYJzH1ZO

Score
10/10
dridexbotnetevasiontrojan

Malware Config

Extracted

Family

dridex

C2

185.206.146.88:443

5.44.45.177:443

185.16.41.224:443

Targets

    • Target

      cd32a737fcba8198d43fed5a68348f983f7713f79574a710deb7759e5a1301eb.exe

    • Size

      159KB

    • MD5

      72fe19810a9089cd1ec3ac5ddda22d3f

    • SHA1

      cecbd09b389a6f4e3ac7a81a9280e1893a6066ae

    • SHA256

      cd32a737fcba8198d43fed5a68348f983f7713f79574a710deb7759e5a1301eb

    • SHA512

      619fbdec0c6639ad0a15ac27a5de41fc302d671740f3b0f19be362a2110355c51f93898ed408b337f73623b1210ed0dd4585acfd6603b9ce767faeb84d1b40f6

    • SSDEEP

      3072:LjM4omazat8Sm0JjICd0BKTGAu+vEegNgbRvFcka8rKVO3gFtvlpb/:LjM4oFMYCyoqAuOEuV9cz8rKO4V

    Score
    10/10
    dridexbotnetevasiontrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Deletes itself

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

System Information Discovery

1
T1082

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Tasks