General

  • Target

    60748859ab0d2a1efadd9d63a631956287ad719e8fe3442f749d416f3b7ed54a

  • Size

    1.4MB

  • Sample

    250206-hq9zvawqcv

  • MD5

    96aa3da27979e306beb1ec5cb1c74532

  • SHA1

    35179d373827f0adfe22cd4e08871ddaa7e2078c

  • SHA256

    60748859ab0d2a1efadd9d63a631956287ad719e8fe3442f749d416f3b7ed54a

  • SHA512

    8c5e3585a2032491eb1eb3c3173de6aa3d881a0de742f39727a0036120e51d954c971bde86ef19c0e13bff37b13bea4872402ea9f6d7b792f818b76fa1d34c59

  • SSDEEP

    3072:5xSm9vz5ZNgWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIpHK:nZvfjqel7oe4nmOXouZqZGa

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

162.241.44.26:9443

185.184.25.234:4664

138.201.138.91:3389

rc4.plain
rc4.plain

Targets

    • Target

      60748859ab0d2a1efadd9d63a631956287ad719e8fe3442f749d416f3b7ed54a

    • Size

      1.4MB

    • MD5

      96aa3da27979e306beb1ec5cb1c74532

    • SHA1

      35179d373827f0adfe22cd4e08871ddaa7e2078c

    • SHA256

      60748859ab0d2a1efadd9d63a631956287ad719e8fe3442f749d416f3b7ed54a

    • SHA512

      8c5e3585a2032491eb1eb3c3173de6aa3d881a0de742f39727a0036120e51d954c971bde86ef19c0e13bff37b13bea4872402ea9f6d7b792f818b76fa1d34c59

    • SSDEEP

      3072:5xSm9vz5ZNgWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIpHK:nZvfjqel7oe4nmOXouZqZGa

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks