General

  • Target

    a21cff8de196daa4fbb86fe6514b67bbef7805ce8ef48e5faa6db9936d219a65

  • Size

    1.4MB

  • Sample

    250116-hxpbqayrfl

  • MD5

    3b5fa13edb1ed6d7ce79084f544883b4

  • SHA1

    f28df7ee0571da9751d08c45a495550a24fa6ac8

  • SHA256

    a21cff8de196daa4fbb86fe6514b67bbef7805ce8ef48e5faa6db9936d219a65

  • SHA512

    24473397e9bf128782a48bc9dbbffa6effa15f32a44fae67a43426f76dd5d7a25abb20319e16f65ae7e00540a9f0f3237a734100f243b54f91eb16d07731084a

  • SSDEEP

    3072:tjwDm1gWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxXgXTP+8rGV:tjwDmrqel7oe4nmOXouZRoGo

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

157.7.166.26:5353

162.144.127.197:3786

46.22.57.17:5037

rc4.plain
rc4.plain

Targets

    • Target

      a21cff8de196daa4fbb86fe6514b67bbef7805ce8ef48e5faa6db9936d219a65

    • Size

      1.4MB

    • MD5

      3b5fa13edb1ed6d7ce79084f544883b4

    • SHA1

      f28df7ee0571da9751d08c45a495550a24fa6ac8

    • SHA256

      a21cff8de196daa4fbb86fe6514b67bbef7805ce8ef48e5faa6db9936d219a65

    • SHA512

      24473397e9bf128782a48bc9dbbffa6effa15f32a44fae67a43426f76dd5d7a25abb20319e16f65ae7e00540a9f0f3237a734100f243b54f91eb16d07731084a

    • SSDEEP

      3072:tjwDm1gWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxXgXTP+8rGV:tjwDmrqel7oe4nmOXouZRoGo

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks