General

  • Target

    625524bd6252191b1be01af8053d20169ea8dc453807649a292a5d577a27ccc0.exe

  • Size

    481KB

  • Sample

    241122-x28cqawrf1

  • MD5

    08de366109d61ddb49df67ab1c00afc4

  • SHA1

    01d3b52ee9c6ebacd853b0d0bc665c274c9ad654

  • SHA256

    625524bd6252191b1be01af8053d20169ea8dc453807649a292a5d577a27ccc0

  • SHA512

    8deea453d756c6a2cec4d738161b570adfbbb876789815445ebd883664fee591f5c8b1d55d3d4d40e9e9e722d8fda20738a5b061b69bc27f3e0dc222eadaf16d

  • SSDEEP

    6144:0jsulkCwDvneDKUuSB0CxaCIjRWNtttZdJxBvgHLWMm2caK4uKc5qCdBm:02rDvne0S6e0jQVZdrBFaynjm

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

195.210.28.115:7443

211.172.241.52:9676

87.121.52.85:6225

rc4.plain
rc4.plain

Targets

    • Target

      625524bd6252191b1be01af8053d20169ea8dc453807649a292a5d577a27ccc0.exe

    • Size

      481KB

    • MD5

      08de366109d61ddb49df67ab1c00afc4

    • SHA1

      01d3b52ee9c6ebacd853b0d0bc665c274c9ad654

    • SHA256

      625524bd6252191b1be01af8053d20169ea8dc453807649a292a5d577a27ccc0

    • SHA512

      8deea453d756c6a2cec4d738161b570adfbbb876789815445ebd883664fee591f5c8b1d55d3d4d40e9e9e722d8fda20738a5b061b69bc27f3e0dc222eadaf16d

    • SSDEEP

      6144:0jsulkCwDvneDKUuSB0CxaCIjRWNtttZdJxBvgHLWMm2caK4uKc5qCdBm:02rDvne0S6e0jQVZdrBFaynjm

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks