General

  • Target

    e957de538126a39b131d168ae2b081fcd9c859fff85428ddaf0dd30c08dbf4ed

  • Size

    1.4MB

  • Sample

    250123-hf8n2axmfw

  • MD5

    44cb607d4c6ba40c23fb4a812c647799

  • SHA1

    efd9064181ca2c2fdc6ca71305272c2c7cf19526

  • SHA256

    e957de538126a39b131d168ae2b081fcd9c859fff85428ddaf0dd30c08dbf4ed

  • SHA512

    fd48f42c590cfad8c9f3deed33672b0c4948e664069dea8c1b34917b168d0af728bfc7e9dec6105ef20c7cdba7942f8c14f7492a405b94b29d44ba343ab9495c

  • SSDEEP

    3072:PjwDm1gWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxXgXTP+krGV:PjwDmrqel7oe4nmOXouZRgGo

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

157.7.166.26:5353

162.144.127.197:3786

46.22.57.17:5037

rc4.plain
rc4.plain

Targets

    • Target

      e957de538126a39b131d168ae2b081fcd9c859fff85428ddaf0dd30c08dbf4ed

    • Size

      1.4MB

    • MD5

      44cb607d4c6ba40c23fb4a812c647799

    • SHA1

      efd9064181ca2c2fdc6ca71305272c2c7cf19526

    • SHA256

      e957de538126a39b131d168ae2b081fcd9c859fff85428ddaf0dd30c08dbf4ed

    • SHA512

      fd48f42c590cfad8c9f3deed33672b0c4948e664069dea8c1b34917b168d0af728bfc7e9dec6105ef20c7cdba7942f8c14f7492a405b94b29d44ba343ab9495c

    • SSDEEP

      3072:PjwDm1gWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxXgXTP+krGV:PjwDmrqel7oe4nmOXouZRgGo

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks