Resubmissions

12-01-2025 09:34

250112-lj277swray 10

12-01-2025 06:56

250112-hqh65atnfp 10

General

  • Target

    a90494983eb3fac0947fb2bdf6623d79d06617f70f5484a8f0157d164bc05db6

  • Size

    551KB

  • Sample

    250112-hqh65atnfp

  • MD5

    70083896ba2fc7647d0c6f874d7b5235

  • SHA1

    da48bb939ab76f44ef25e9fd89d5fd4ce6676a99

  • SHA256

    a90494983eb3fac0947fb2bdf6623d79d06617f70f5484a8f0157d164bc05db6

  • SHA512

    e79ba1fee08687b69192e0c73890bb191553e3c2108c45ab59ac367fd54799862c76ac89ee5442b5d7ae661cf665aae9b15a3c6db715b5af25570d14cbd8c660

  • SSDEEP

    3072:b3q30gWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIpMWMHmIY:moqel7oe4nmOXouZqLXJa5Ga

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

162.241.44.26:9443

185.184.25.234:4664

138.201.138.91:3389

rc4.plain
rc4.plain

Targets

    • Target

      a90494983eb3fac0947fb2bdf6623d79d06617f70f5484a8f0157d164bc05db6

    • Size

      551KB

    • MD5

      70083896ba2fc7647d0c6f874d7b5235

    • SHA1

      da48bb939ab76f44ef25e9fd89d5fd4ce6676a99

    • SHA256

      a90494983eb3fac0947fb2bdf6623d79d06617f70f5484a8f0157d164bc05db6

    • SHA512

      e79ba1fee08687b69192e0c73890bb191553e3c2108c45ab59ac367fd54799862c76ac89ee5442b5d7ae661cf665aae9b15a3c6db715b5af25570d14cbd8c660

    • SSDEEP

      3072:b3q30gWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIpMWMHmIY:moqel7oe4nmOXouZqLXJa5Ga

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks