General

  • Target

    3f1e0bdfa469e946b577296c8deec1bc02496fc95c0270be6fe23cda9ab54d4b

  • Size

    1.1MB

  • Sample

    250116-hx7s3ayjhv

  • MD5

    274c32d852214ad411f92a68305cfe3f

  • SHA1

    57268277aac0662813e354254a812b1250d14158

  • SHA256

    3f1e0bdfa469e946b577296c8deec1bc02496fc95c0270be6fe23cda9ab54d4b

  • SHA512

    c14ef2057f64fd8858608af2f35c8cd7b7d520a65051db15a3caf785a43d8071851dc0fa12c174bc6797b38c09c2c5d4a097e94917c7971aa5b02bc344090125

  • SSDEEP

    3072:IzW15DVagWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIptWMM:fVCqel7oe4nmOXouZq+XJa5Ga

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

162.241.44.26:9443

185.184.25.234:4664

138.201.138.91:3389

rc4.plain
rc4.plain

Targets

    • Target

      3f1e0bdfa469e946b577296c8deec1bc02496fc95c0270be6fe23cda9ab54d4b

    • Size

      1.1MB

    • MD5

      274c32d852214ad411f92a68305cfe3f

    • SHA1

      57268277aac0662813e354254a812b1250d14158

    • SHA256

      3f1e0bdfa469e946b577296c8deec1bc02496fc95c0270be6fe23cda9ab54d4b

    • SHA512

      c14ef2057f64fd8858608af2f35c8cd7b7d520a65051db15a3caf785a43d8071851dc0fa12c174bc6797b38c09c2c5d4a097e94917c7971aa5b02bc344090125

    • SSDEEP

      3072:IzW15DVagWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIptWMM:fVCqel7oe4nmOXouZq+XJa5Ga

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks