General

  • Target

    a4634528dd7dc36c98ebb80d9f68921ffad4ad1eedcf160cfda5bc421e050bf6

  • Size

    1.1MB

  • Sample

    250205-hn9w3awqen

  • MD5

    78c0f8e6565a6e0d253fc50554e15ffa

  • SHA1

    a4e5f8b66b7fd336f7a3ac5881c8f428fd8c6e70

  • SHA256

    a4634528dd7dc36c98ebb80d9f68921ffad4ad1eedcf160cfda5bc421e050bf6

  • SHA512

    a9ad0801d53f97a526595dc93bc2678cefbf3a36a7884bb24a1e1fa6b1e626f0c6199866ecded22f459d587904ea4e9329e854f8add08fb6721173b6b7d3e3ed

  • SSDEEP

    3072:LzW15DVagWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIpYWMM:QVCqel7oe4nmOXouZqzXJa5Ga

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

162.241.44.26:9443

185.184.25.234:4664

138.201.138.91:3389

rc4.plain
rc4.plain

Targets

    • Target

      a4634528dd7dc36c98ebb80d9f68921ffad4ad1eedcf160cfda5bc421e050bf6

    • Size

      1.1MB

    • MD5

      78c0f8e6565a6e0d253fc50554e15ffa

    • SHA1

      a4e5f8b66b7fd336f7a3ac5881c8f428fd8c6e70

    • SHA256

      a4634528dd7dc36c98ebb80d9f68921ffad4ad1eedcf160cfda5bc421e050bf6

    • SHA512

      a9ad0801d53f97a526595dc93bc2678cefbf3a36a7884bb24a1e1fa6b1e626f0c6199866ecded22f459d587904ea4e9329e854f8add08fb6721173b6b7d3e3ed

    • SSDEEP

      3072:LzW15DVagWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIpYWMM:QVCqel7oe4nmOXouZqzXJa5Ga

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks