General
-
Target
kqgnyb.tar
-
Size
785KB
-
Sample
230630-p3eg2adf7z
-
MD5
29517d23a58b39ee49f9b966eeb114a2
-
SHA1
ecb76eb685dce686ac2fb8d2a8a381a08dc540eb
-
SHA256
24275f73c8faf326ccfe1dff433841bd84a13af9d37bae065585cb8a05589968
-
SHA512
a9bd42d1448a35deaded45ca5e87fac381735dba7ef3dd67f239d7a24cf083d04ba3f32c5366149ffe71dd8d167a54fe6c01711d3233308f6c8065341c60aae5
-
SSDEEP
12288:MbqkjZr1Vu8MpJYosZUmc16RWdrpo8+FFcLxT8HoxmRsDJteMKTO81MOU7qOkQR1:MbqkjZrqxYjxoArwQobmMKFiOUFkK1
Static task
static1
Behavioral task
behavioral1
Sample
kqgnyb.dll
Resource
win7-20230621-en
Malware Config
Extracted
dridex
10444
209.20.87.138:443
198.1.115.153:8172
151.236.29.248:6516
Targets
-
-
Target
kqgnyb.tar
-
Size
785KB
-
MD5
29517d23a58b39ee49f9b966eeb114a2
-
SHA1
ecb76eb685dce686ac2fb8d2a8a381a08dc540eb
-
SHA256
24275f73c8faf326ccfe1dff433841bd84a13af9d37bae065585cb8a05589968
-
SHA512
a9bd42d1448a35deaded45ca5e87fac381735dba7ef3dd67f239d7a24cf083d04ba3f32c5366149ffe71dd8d167a54fe6c01711d3233308f6c8065341c60aae5
-
SSDEEP
12288:MbqkjZr1Vu8MpJYosZUmc16RWdrpo8+FFcLxT8HoxmRsDJteMKTO81MOU7qOkQR1:MbqkjZrqxYjxoArwQobmMKFiOUFkK1
-
Blocklisted process makes network request
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-