General

  • Target

    f31c384de9812f9bbc0a10fb3c7638629a906ec226626098b6f61f4405449ca0

  • Size

    1.1MB

  • Sample

    250115-ghzngasqbz

  • MD5

    0afa4162bacc4ead9c446e3225e85f74

  • SHA1

    f131a84657defdf6a73096440172644da1759229

  • SHA256

    f31c384de9812f9bbc0a10fb3c7638629a906ec226626098b6f61f4405449ca0

  • SHA512

    22f3e804803ee0983fb6ab26a6aa395c01be292316c3cb1a7ea7e6a632b7846d5afed769b3973f3cbd28226ab041f0305d239191b6df54469ed7f175aee6605f

  • SSDEEP

    3072:KzW15DVagWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIp3WMM:1VCqel7oe4nmOXouZqkXJa5Ga

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

162.241.44.26:9443

185.184.25.234:4664

138.201.138.91:3389

rc4.plain
rc4.plain

Targets

    • Target

      f31c384de9812f9bbc0a10fb3c7638629a906ec226626098b6f61f4405449ca0

    • Size

      1.1MB

    • MD5

      0afa4162bacc4ead9c446e3225e85f74

    • SHA1

      f131a84657defdf6a73096440172644da1759229

    • SHA256

      f31c384de9812f9bbc0a10fb3c7638629a906ec226626098b6f61f4405449ca0

    • SHA512

      22f3e804803ee0983fb6ab26a6aa395c01be292316c3cb1a7ea7e6a632b7846d5afed769b3973f3cbd28226ab041f0305d239191b6df54469ed7f175aee6605f

    • SSDEEP

      3072:KzW15DVagWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIp3WMM:1VCqel7oe4nmOXouZqkXJa5Ga

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks