General

  • Target

    871588a9ecd1c56ba0dbb129b48537a292052dd3c4c7aeae62d50d8fa69c2dff

  • Size

    1.4MB

  • Sample

    250114-jnqc4atnfm

  • MD5

    22e33a7979b62193076f120a97b4af66

  • SHA1

    a9016a2811f440406eba4352a6ee2f10a07e10fc

  • SHA256

    871588a9ecd1c56ba0dbb129b48537a292052dd3c4c7aeae62d50d8fa69c2dff

  • SHA512

    49cfb32f2e29fd917977f0c8a2672c925d733d417ae5137c3de32ab77741aa166b0214910c23a702234fbc7f7d5264154c41d0fabd921126b621614b8ee39b79

  • SSDEEP

    6144:IIzeqel7oe4nmOXouZq2IzRq5ppFIztKXJa5Ga:m7oe4nmqWKZaL

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

162.241.44.26:9443

185.184.25.234:4664

138.201.138.91:3389

rc4.plain
rc4.plain

Targets

    • Target

      871588a9ecd1c56ba0dbb129b48537a292052dd3c4c7aeae62d50d8fa69c2dff

    • Size

      1.4MB

    • MD5

      22e33a7979b62193076f120a97b4af66

    • SHA1

      a9016a2811f440406eba4352a6ee2f10a07e10fc

    • SHA256

      871588a9ecd1c56ba0dbb129b48537a292052dd3c4c7aeae62d50d8fa69c2dff

    • SHA512

      49cfb32f2e29fd917977f0c8a2672c925d733d417ae5137c3de32ab77741aa166b0214910c23a702234fbc7f7d5264154c41d0fabd921126b621614b8ee39b79

    • SSDEEP

      6144:IIzeqel7oe4nmOXouZq2IzRq5ppFIztKXJa5Ga:m7oe4nmqWKZaL

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks