Overview

overview

10

Static

static

1

cd32a737fc...eb.exe

windows7-x64

10

cd32a737fc...eb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cd32a737fcba8198d43fed5a68348f983f7713f79574a710deb7759e5a1301eb.zip

  • Size

    131KB

  • Sample

    230310-nl46padd45

  • MD5

    6950f2940474f04ea020b5bdc2bc085c

  • SHA1

    def315da25ede6779ba71bc278f7bc76db6aa9c0

  • SHA256

    efbf22652aa42b6b3bad6d39387e537f09a1bb1ec34f319da1f25f2e388d5925

  • SHA512

    3488358a35bea9fc68c5382c9a4b84c645494ba33489788796899f242f92e071aa1c30d0905d431bb3c2b6afcfe66ed5f185f6d01758cdfac54b1f5bbb015925

  • SSDEEP

    3072:SBEAgRZ/6fo1A3p0x3C1VyzHytBdVHBFB7v1r+vzhPP:SBEP3/6kA5qSyzSFVrXrcBP

Score
10/10
dridexbotnetevasiontrojan

Malware Config

Extracted

Family

dridex

C2

185.206.146.88:443

5.44.45.177:443

185.16.41.224:443

Targets

    • Target

      cd32a737fcba8198d43fed5a68348f983f7713f79574a710deb7759e5a1301eb.exe

    • Size

      159KB

    • MD5

      72fe19810a9089cd1ec3ac5ddda22d3f

    • SHA1

      cecbd09b389a6f4e3ac7a81a9280e1893a6066ae

    • SHA256

      cd32a737fcba8198d43fed5a68348f983f7713f79574a710deb7759e5a1301eb

    • SHA512

      619fbdec0c6639ad0a15ac27a5de41fc302d671740f3b0f19be362a2110355c51f93898ed408b337f73623b1210ed0dd4585acfd6603b9ce767faeb84d1b40f6

    • SSDEEP

      3072:LjM4omazat8Sm0JjICd0BKTGAu+vEegNgbRvFcka8rKVO3gFtvlpb/:LjM4oFMYCyoqAuOEuV9cz8rKO4V

    Score
    10/10
    dridexbotnetevasiontrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Deletes itself

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

System Information Discovery

1
T1082

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Tasks