General

  • Target

    05408b987f708cfc2db4d2af99781ac94c4b98ba7b2248731fcf82ccdaf4ac56

  • Size

    1.1MB

  • Sample

    241220-g6hpvs1rev

  • MD5

    458bbdbe365e2c999429dd97c0081a85

  • SHA1

    7e1a258dcdcbae356b85aaa158fe34ef53ac4c21

  • SHA256

    05408b987f708cfc2db4d2af99781ac94c4b98ba7b2248731fcf82ccdaf4ac56

  • SHA512

    e8fb6fa73c1e738d04d93f5457d080c06554f45ec44c55f859202596c7b2df22aed311a63b29a350bd32957e337f2e066e3c87651146027a31f9b24867063636

  • SSDEEP

    3072:v4UVgWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIpbWMHmIsx:FLqel7oe4nmOXouZqcXJa5Ga

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

162.241.44.26:9443

185.184.25.234:4664

138.201.138.91:3389

rc4.plain
rc4.plain

Targets

    • Target

      05408b987f708cfc2db4d2af99781ac94c4b98ba7b2248731fcf82ccdaf4ac56

    • Size

      1.1MB

    • MD5

      458bbdbe365e2c999429dd97c0081a85

    • SHA1

      7e1a258dcdcbae356b85aaa158fe34ef53ac4c21

    • SHA256

      05408b987f708cfc2db4d2af99781ac94c4b98ba7b2248731fcf82ccdaf4ac56

    • SHA512

      e8fb6fa73c1e738d04d93f5457d080c06554f45ec44c55f859202596c7b2df22aed311a63b29a350bd32957e337f2e066e3c87651146027a31f9b24867063636

    • SSDEEP

      3072:v4UVgWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIpbWMHmIsx:FLqel7oe4nmOXouZqcXJa5Ga

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks