General

  • Target

    0e84e46df1fa5ae7a13bd87bca18867e28e28b1dae9972d9be608303674d6452

  • Size

    1.1MB

  • Sample

    250109-g8kbga1qgv

  • MD5

    485f3581a0dde228de1652365c7648af

  • SHA1

    c3a686b2dfa173f6bc2cf5160eb1cb8bab5e0942

  • SHA256

    0e84e46df1fa5ae7a13bd87bca18867e28e28b1dae9972d9be608303674d6452

  • SHA512

    71c0042c224f03c99c59bc4b2bf26d0c4886c7cc50ad4564502eefd757f761d334ba0ce05f254ef8363e96526325e94d7c614bf69ce118088a235ae1158ccd0d

  • SSDEEP

    3072:dzW15DVagWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIpSWMM:GVCqel7oe4nmOXouZqdXJa5Ga

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

162.241.44.26:9443

185.184.25.234:4664

138.201.138.91:3389

rc4.plain
rc4.plain

Targets

    • Target

      0e84e46df1fa5ae7a13bd87bca18867e28e28b1dae9972d9be608303674d6452

    • Size

      1.1MB

    • MD5

      485f3581a0dde228de1652365c7648af

    • SHA1

      c3a686b2dfa173f6bc2cf5160eb1cb8bab5e0942

    • SHA256

      0e84e46df1fa5ae7a13bd87bca18867e28e28b1dae9972d9be608303674d6452

    • SHA512

      71c0042c224f03c99c59bc4b2bf26d0c4886c7cc50ad4564502eefd757f761d334ba0ce05f254ef8363e96526325e94d7c614bf69ce118088a235ae1158ccd0d

    • SSDEEP

      3072:dzW15DVagWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIpSWMM:GVCqel7oe4nmOXouZqdXJa5Ga

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks