General

  • Target

    110bc2e99dc4b60ad0c0aaf8c172ca55eedb0039cef925889b0c611dbe9e771f

  • Size

    1.0MB

  • Sample

    250110-g54wpsxnak

  • MD5

    67475f190fc950a80e8800c788b31b89

  • SHA1

    2b96626cfe9e8692338579c793ab08fd69583a07

  • SHA256

    110bc2e99dc4b60ad0c0aaf8c172ca55eedb0039cef925889b0c611dbe9e771f

  • SHA512

    53853d27c521dcc21328fbf02fc7911e3cdb940f06fe6c48b84a2cf079b32f826de16a9b49f4e63de13d889b48ef0428797797e098c1e5861f70b2b27b299a08

  • SSDEEP

    6144:6p3qel7oe4nmOXouZqHpLq5ppFpTXJa5Ga:M7oe4nmqfZaL

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

162.241.44.26:9443

185.184.25.234:4664

138.201.138.91:3389

rc4.plain
rc4.plain

Targets

    • Target

      110bc2e99dc4b60ad0c0aaf8c172ca55eedb0039cef925889b0c611dbe9e771f

    • Size

      1.0MB

    • MD5

      67475f190fc950a80e8800c788b31b89

    • SHA1

      2b96626cfe9e8692338579c793ab08fd69583a07

    • SHA256

      110bc2e99dc4b60ad0c0aaf8c172ca55eedb0039cef925889b0c611dbe9e771f

    • SHA512

      53853d27c521dcc21328fbf02fc7911e3cdb940f06fe6c48b84a2cf079b32f826de16a9b49f4e63de13d889b48ef0428797797e098c1e5861f70b2b27b299a08

    • SSDEEP

      6144:6p3qel7oe4nmOXouZqHpLq5ppFpTXJa5Ga:M7oe4nmqfZaL

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks