Overview

overview

10

Static

static

1

1d778359ab...05.exe

windows7-x64

10

1d778359ab...05.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1d778359ab155cb190b9f2a7086c3bcb4082aa195ff8f754dae2d665fd20aa05.zip

  • Size

    143KB

  • Sample

    230310-m4v53ada76

  • MD5

    c57db9a42c76768d69be89c84e4ac7ed

  • SHA1

    559aa6d23ec6e4d1e8d718a1be217c6b55264a65

  • SHA256

    7c8693d52d32a346fff833d806d9dc1291f81bb171906fc57d7f2ac28a9b2960

  • SHA512

    008573a3be2d675cd85daca733b41dca52afec14766f7fc379e287f3f44723b72a90061c83dc681f010471d38658dc2da571e4a98fc68c781a9bf6309da38d0b

  • SSDEEP

    3072:LmhVAWa2NtNlM/FyTm+0vV5pIgzUU1BUoV0pwoUMGf4/Zz+liW:Lm8F2NVeqm+0XpIgzUU1WoV0b9xZCliW

Score
10/10
dridexbotnetevasiontrojan

Malware Config

Extracted

Family

dridex

C2

195.123.213.19:443

195.123.238.51:443

45.129.96.9:443

Targets

    • Target

      1d778359ab155cb190b9f2a7086c3bcb4082aa195ff8f754dae2d665fd20aa05.exe

    • Size

      208KB

    • MD5

      d0409052256c6efc85b155f58cc03f70

    • SHA1

      3ab42ca8ce81f9df0c4f7cd807528c5dd0fb5108

    • SHA256

      1d778359ab155cb190b9f2a7086c3bcb4082aa195ff8f754dae2d665fd20aa05

    • SHA512

      3276daa266159b03820abf9e05aeec54e8ba6b748b5f44c76f5d8be0333a45490c7a93df3d227c74e5009b4ac2c08ae05d84862170766c7a304a30cc0bfbc6e5

    • SSDEEP

      3072:ESf6yf4ZtuoMvwloVkldMkPH7fp6CmSIPSi6/8NK3c3:XCyw7cqo+llPHICmSAUJ3

    Score
    10/10
    dridexbotnetevasiontrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Deletes itself

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

System Information Discovery

1
T1082

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Tasks