General

  • Target

    52802da3b5486c887d0b8df4925e79205756ea84a8cf5fa283106185f2eba5dc

  • Size

    1.1MB

  • Sample

    250213-g7nmhatqep

  • MD5

    04a40f4ba30ca4b93235263662ba8a4e

  • SHA1

    94b1d098b8a33724d6bf725c096a432a9420e2c3

  • SHA256

    52802da3b5486c887d0b8df4925e79205756ea84a8cf5fa283106185f2eba5dc

  • SHA512

    b4379eaaaae3c6b4f54d1b7b814de9dae7df0e3c1c988655ecfee17c74651a285357361a3debbd584bffd8ac84cdba406ee839e3936fafaa06c2aa00c58684d1

  • SSDEEP

    3072:aqfW15J8gWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIpcWMM:aqyQqel7oe4nmOXouZqLXJa5Ga

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

162.241.44.26:9443

185.184.25.234:4664

138.201.138.91:3389

rc4.plain
rc4.plain

Targets

    • Target

      52802da3b5486c887d0b8df4925e79205756ea84a8cf5fa283106185f2eba5dc

    • Size

      1.1MB

    • MD5

      04a40f4ba30ca4b93235263662ba8a4e

    • SHA1

      94b1d098b8a33724d6bf725c096a432a9420e2c3

    • SHA256

      52802da3b5486c887d0b8df4925e79205756ea84a8cf5fa283106185f2eba5dc

    • SHA512

      b4379eaaaae3c6b4f54d1b7b814de9dae7df0e3c1c988655ecfee17c74651a285357361a3debbd584bffd8ac84cdba406ee839e3936fafaa06c2aa00c58684d1

    • SSDEEP

      3072:aqfW15J8gWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIpcWMM:aqyQqel7oe4nmOXouZqLXJa5Ga

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Downloads MZ/PE file

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks