Overview

overview

10

Static

static

1

1d778359ab...05.exe

windows7-x64

10

1d778359ab...05.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1d778359ab155cb190b9f2a7086c3bcb4082aa195ff8f754dae2d665fd20aa05.zip

  • Size

    143KB

  • Sample

    230310-nl85msdd56

  • MD5

    d54a9b5d3a197ddd7b205c4e9d5db0c9

  • SHA1

    d4c4b11fbc220f159487030edf03b07060357821

  • SHA256

    308977b7bbb10447349f1e3fe422d9376aa3f21380df96fd69985f654479e6e4

  • SHA512

    56caf0599e16e9f5451c9c97baa64ca5f54de0b8758dd17311ef26d8de188844438570011804610a545b437e274d7d8ec601e0bec9823856998fe67709e0d64f

  • SSDEEP

    3072:PT3RMNc+ELFOfbFj6uRhuDHcMxrw0277shZaPOJQzPNgpiXgTc9xx0LOyvB5VAwR:PTRDhEfbzRhuDrxFxXaWJQzVgpiXWc7u

Score
10/10
dridexbotnetevasiontrojan

Malware Config

Extracted

Family

dridex

C2

195.123.213.19:443

195.123.238.51:443

45.129.96.9:443

Targets

    • Target

      1d778359ab155cb190b9f2a7086c3bcb4082aa195ff8f754dae2d665fd20aa05.exe

    • Size

      208KB

    • MD5

      d0409052256c6efc85b155f58cc03f70

    • SHA1

      3ab42ca8ce81f9df0c4f7cd807528c5dd0fb5108

    • SHA256

      1d778359ab155cb190b9f2a7086c3bcb4082aa195ff8f754dae2d665fd20aa05

    • SHA512

      3276daa266159b03820abf9e05aeec54e8ba6b748b5f44c76f5d8be0333a45490c7a93df3d227c74e5009b4ac2c08ae05d84862170766c7a304a30cc0bfbc6e5

    • SSDEEP

      3072:ESf6yf4ZtuoMvwloVkldMkPH7fp6CmSIPSi6/8NK3c3:XCyw7cqo+llPHICmSAUJ3

    Score
    10/10
    dridexbotnetevasiontrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Deletes itself

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

System Information Discovery

1
T1082

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Tasks