General

  • Target

    0500d9f9581ae3ebab1e89b44f09b18c1e10cfe13a4b9be84114b3544d7c6e53

  • Size

    1.2MB

  • Sample

    241220-jbhsgstqaq

  • MD5

    462c1076f65690f7389f1334023b84b7

  • SHA1

    4269a4b88642af3ddb4e1ca057bc5fa8a1e6beb4

  • SHA256

    0500d9f9581ae3ebab1e89b44f09b18c1e10cfe13a4b9be84114b3544d7c6e53

  • SHA512

    fc8e0cad540a40fb3198b61ab20bb935128d6d1ba368594dcf639f839e0bc653ea39ca57fcb1b6662ea164e7f3b2d416515290477588e84b39fb89cf858d9710

  • SSDEEP

    3072:wnW15JigWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIp4WMHs:wKqqel7oe4nmOXouZqjXJa5Ga

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

162.241.44.26:9443

185.184.25.234:4664

138.201.138.91:3389

rc4.plain
rc4.plain

Targets

    • Target

      0500d9f9581ae3ebab1e89b44f09b18c1e10cfe13a4b9be84114b3544d7c6e53

    • Size

      1.2MB

    • MD5

      462c1076f65690f7389f1334023b84b7

    • SHA1

      4269a4b88642af3ddb4e1ca057bc5fa8a1e6beb4

    • SHA256

      0500d9f9581ae3ebab1e89b44f09b18c1e10cfe13a4b9be84114b3544d7c6e53

    • SHA512

      fc8e0cad540a40fb3198b61ab20bb935128d6d1ba368594dcf639f839e0bc653ea39ca57fcb1b6662ea164e7f3b2d416515290477588e84b39fb89cf858d9710

    • SSDEEP

      3072:wnW15JigWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIp4WMHs:wKqqel7oe4nmOXouZqjXJa5Ga

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks