General

  • Target

    9858634888d0264fc991b8467cb05feb.zip

  • Size

    391KB

  • Sample

    240831-eny8savdmc

  • MD5

    1cfaedfdfa9486f5a59891fea7729dbb

  • SHA1

    a470edc0ad35406ebbaa829f984ed97a821feae1

  • SHA256

    8ee793372a8f44a826d47e4945960a6259bba8fc1b96477ddc5eb4060d959d77

  • SHA512

    ee75fbb28f1327274d7616d438c49e333976f7fe5b3e49882050823308c1c8fa6d960f555e88265eaebee231dd423c54f8550cfd1f6caea632ba5c8c190bf0b9

  • SSDEEP

    6144:iLaqYzMJMv9AtwAT41d9jsLv2zKrSCpaHlF6DJ3ok1pDoh3/aKTE3Oz2Y/PxKTPc:caXgJMEMdOiu314cG3itOz2hPVX8Xn

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

174.128.245.202:443

51.83.3.52:13786

69.64.50.41:6602

rc4.plain
rc4.plain

Targets

    • Target

      0691382a2170a87fc1969b83df550a67adbe560e5885dace85bf26027f24af1d

    • Size

      608KB

    • MD5

      9858634888d0264fc991b8467cb05feb

    • SHA1

      13495d353bd3005bfa0aae96c45e204f99bd7058

    • SHA256

      0691382a2170a87fc1969b83df550a67adbe560e5885dace85bf26027f24af1d

    • SHA512

      5b2a31875ca71ad5accb1cfcc17d2f603c13e06db5ba15c1ad98eeec5ee3ee49d704df99b2b5b2fd5af80033aee49ca5b4c09a9cb53c5442849ddc987db6891f

    • SSDEEP

      12288:gZGQdqOGHxJqydLqQSeCqsVK8kPRGO35N9mVZzXc6k:gZ05WjeCVVK8kP9N9oVu

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks