General

  • Target

    c004c6eee0157b72d7eb5256dbd6222764614adf39008348f7022556a1d4bf4e

  • Size

    1.4MB

  • Sample

    250112-gxmx8azmfs

  • MD5

    15effb347991c194aec35e69eb4b69d3

  • SHA1

    ba8677ceec2d541d94c11c4c84426dab30fa66c1

  • SHA256

    c004c6eee0157b72d7eb5256dbd6222764614adf39008348f7022556a1d4bf4e

  • SHA512

    d70677e3e405dde7cfa5df1c4a73a7f08a9a4fb1734e6aa905ffe8874193f254416c65ae06f766e6f79c80f206c5a3771ee9e53210817bd7022b6d477d91986c

  • SSDEEP

    3072:hjwDm1gWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxXgXTP+grGV:hjwDmrqel7oe4nmOXouZRsGo

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

157.7.166.26:5353

162.144.127.197:3786

46.22.57.17:5037

rc4.plain
rc4.plain

Targets

    • Target

      c004c6eee0157b72d7eb5256dbd6222764614adf39008348f7022556a1d4bf4e

    • Size

      1.4MB

    • MD5

      15effb347991c194aec35e69eb4b69d3

    • SHA1

      ba8677ceec2d541d94c11c4c84426dab30fa66c1

    • SHA256

      c004c6eee0157b72d7eb5256dbd6222764614adf39008348f7022556a1d4bf4e

    • SHA512

      d70677e3e405dde7cfa5df1c4a73a7f08a9a4fb1734e6aa905ffe8874193f254416c65ae06f766e6f79c80f206c5a3771ee9e53210817bd7022b6d477d91986c

    • SSDEEP

      3072:hjwDm1gWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxXgXTP+grGV:hjwDmrqel7oe4nmOXouZRsGo

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks