Overview

overview

10

Static

static

1

mea_1900896332082.vbs

windows7-x64

10

mea_1900896332082.vbs

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    57e5cbbeeeae9a8145960faf3f0f0b07_JaffaCakes118

  • Size

    362KB

  • Sample

    240519-bxg43sbd2s

  • MD5

    57e5cbbeeeae9a8145960faf3f0f0b07

  • SHA1

    573f88bbd4b8bf3d06267a4978200eefe7355a65

  • SHA256

    03861041e8b7e2e566ddf2bdc50b1bff9a133f5d98c16ff7d882a1305bfd7f95

  • SHA512

    77cc40f4849670087a15d461267356ff172bee4f58bdda11f12779549e5661e849a545084cb9ec8b6930dcdabfe5fef53b03ec900456d0aa0bb9fb42d2b28f8e

  • SSDEEP

    6144:KYndNHJRYqBmAlsbz7t7NiNz7h3v6MsnTl0UE+pBl/VhuhfooeW38mhvr1+lY91r:NndJJ+qBmAlsh7MNPJRsfpT4foXW3VvL

Score
10/10
dridexbotnet

Malware Config

Extracted

Family

dridex

C2

37.247.54.134:443

192.232.207.243:8443

82.165.38.218:691

188.166.73.181:1443

Targets

    • Target

      mea_1900896332082.vbs

    • Size

      1.4MB

    • MD5

      29d21d21ef6b4a52c649053bbc3a7ec9

    • SHA1

      0e5afb55e844aa0d77f7582271f7be13e5f28098

    • SHA256

      55df7615b08d6a53ffb0297d21870a31b4db316290d605e3b0864cd1aa765932

    • SHA512

      4470741448d0e112e955a78805de4237046753b62c42da1da12a39dda31efbf44d56af80f29f3af1a7fed32dcf268638173387016ef4747a2e2175e7bb1bc635

    • SSDEEP

      12288:Bg0It4oS5BVgf7UCahK7Kp7/RY0x1ue0rDxpKtABX0yeiL6iwDN/aXK8j4Rqnnqg:s

    Score
    10/10
    dridexbotnet

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks