General

  • Target

    110c0e2813829aec383d8ae593f1ad9cd215a1e61358f3d5c814d884439a2f66

  • Size

    1.1MB

  • Sample

    250110-g1cxesxlej

  • MD5

    54e75e4786ccb47b19a73a061377c622

  • SHA1

    bdeb58db26998ad0784d4cf92ef15206d376aa14

  • SHA256

    110c0e2813829aec383d8ae593f1ad9cd215a1e61358f3d5c814d884439a2f66

  • SHA512

    7b6c1f9eed0c28bc45ee2199f4a48e35379e0c985f8ddae260471737e27aa64844a7f648a5574f3982d420cbed76bb6f780247e8a3e361f35340d56553e1b79d

  • SSDEEP

    3072:MzW15DVagWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIpxWMM:bVCqel7oe4nmOXouZq+XJa5Ga

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

162.241.44.26:9443

185.184.25.234:4664

138.201.138.91:3389

rc4.plain
rc4.plain

Targets

    • Target

      110c0e2813829aec383d8ae593f1ad9cd215a1e61358f3d5c814d884439a2f66

    • Size

      1.1MB

    • MD5

      54e75e4786ccb47b19a73a061377c622

    • SHA1

      bdeb58db26998ad0784d4cf92ef15206d376aa14

    • SHA256

      110c0e2813829aec383d8ae593f1ad9cd215a1e61358f3d5c814d884439a2f66

    • SHA512

      7b6c1f9eed0c28bc45ee2199f4a48e35379e0c985f8ddae260471737e27aa64844a7f648a5574f3982d420cbed76bb6f780247e8a3e361f35340d56553e1b79d

    • SSDEEP

      3072:MzW15DVagWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIpxWMM:bVCqel7oe4nmOXouZq+XJa5Ga

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks