General

  • Target

    9c04d260558a1e834e908c3958c40797c3ea6115f142eac85f0157d582cd4991

  • Size

    1.1MB

  • Sample

    250112-hpahlatnbl

  • MD5

    81169dd2a321efbf9c5a8a409e90e8bd

  • SHA1

    91ea0f5a37837e9d3aa2294cd449fd3a500e0ac9

  • SHA256

    9c04d260558a1e834e908c3958c40797c3ea6115f142eac85f0157d582cd4991

  • SHA512

    ef79e48a20a831728ce60e7042ccfe90fe1705298a6ee3ce85a6478eb2694ba9dec18428953dbaa02f0e4d086c7f2b3e1ecc3d95dd8ab81fcdc36f131934bf8a

  • SSDEEP

    3072:lzW15DVagWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIpSWMM:+VCqel7oe4nmOXouZqVXJa5Ga

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

162.241.44.26:9443

185.184.25.234:4664

138.201.138.91:3389

rc4.plain
rc4.plain

Targets

    • Target

      9c04d260558a1e834e908c3958c40797c3ea6115f142eac85f0157d582cd4991

    • Size

      1.1MB

    • MD5

      81169dd2a321efbf9c5a8a409e90e8bd

    • SHA1

      91ea0f5a37837e9d3aa2294cd449fd3a500e0ac9

    • SHA256

      9c04d260558a1e834e908c3958c40797c3ea6115f142eac85f0157d582cd4991

    • SHA512

      ef79e48a20a831728ce60e7042ccfe90fe1705298a6ee3ce85a6478eb2694ba9dec18428953dbaa02f0e4d086c7f2b3e1ecc3d95dd8ab81fcdc36f131934bf8a

    • SSDEEP

      3072:lzW15DVagWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIpSWMM:+VCqel7oe4nmOXouZqVXJa5Ga

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks