General

  • Target

    13104dd081b7ae2af298fdbb2bcddb465648c4d152253451f367811f00d10d23

  • Size

    1.1MB

  • Sample

    250110-md4phs1qds

  • MD5

    6f8ec808b5541f49e80ea9a690349627

  • SHA1

    10df14af53df1080c507133b5c2da9c453a38363

  • SHA256

    13104dd081b7ae2af298fdbb2bcddb465648c4d152253451f367811f00d10d23

  • SHA512

    47d9cdf0978057ed845a5ee6cb3c9491994c1470c1ba8a9570970d2abc636e0c6f2deae650120705d2225dfced75b7cf016a5e531d2ec16c9204d8444cc5e099

  • SSDEEP

    3072:4zW15DVagWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIpRWMM:PVCqel7oe4nmOXouZqaXJa5Ga

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

162.241.44.26:9443

185.184.25.234:4664

138.201.138.91:3389

rc4.plain
rc4.plain

Targets

    • Target

      13104dd081b7ae2af298fdbb2bcddb465648c4d152253451f367811f00d10d23

    • Size

      1.1MB

    • MD5

      6f8ec808b5541f49e80ea9a690349627

    • SHA1

      10df14af53df1080c507133b5c2da9c453a38363

    • SHA256

      13104dd081b7ae2af298fdbb2bcddb465648c4d152253451f367811f00d10d23

    • SHA512

      47d9cdf0978057ed845a5ee6cb3c9491994c1470c1ba8a9570970d2abc636e0c6f2deae650120705d2225dfced75b7cf016a5e531d2ec16c9204d8444cc5e099

    • SSDEEP

      3072:4zW15DVagWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIpRWMM:PVCqel7oe4nmOXouZqaXJa5Ga

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks