General

  • Target

    3b881fd82cd4c4cd2814471e1cc6e72687ac7e9972b24602751031e562be3dd2

  • Size

    1.2MB

  • Sample

    250215-hr3bdswrez

  • MD5

    0fbfcb9ce1efe0ec068e13830873fb54

  • SHA1

    e7f7daa36010c372e2de9b76f197c7653a947a1c

  • SHA256

    3b881fd82cd4c4cd2814471e1cc6e72687ac7e9972b24602751031e562be3dd2

  • SHA512

    cee5c1111e507f37247fb48dcba8d815266de48261c52fef3601659621f8d9c44512c442911db830a130b39ce4a4b0987872536307a730c13359d59c9f9f24a6

  • SSDEEP

    3072:RnW15JigWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIp7WMHs:RKqqel7oe4nmOXouZq8XJa5Ga

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

162.241.44.26:9443

185.184.25.234:4664

138.201.138.91:3389

rc4.plain
rc4.plain

Targets

    • Target

      3b881fd82cd4c4cd2814471e1cc6e72687ac7e9972b24602751031e562be3dd2

    • Size

      1.2MB

    • MD5

      0fbfcb9ce1efe0ec068e13830873fb54

    • SHA1

      e7f7daa36010c372e2de9b76f197c7653a947a1c

    • SHA256

      3b881fd82cd4c4cd2814471e1cc6e72687ac7e9972b24602751031e562be3dd2

    • SHA512

      cee5c1111e507f37247fb48dcba8d815266de48261c52fef3601659621f8d9c44512c442911db830a130b39ce4a4b0987872536307a730c13359d59c9f9f24a6

    • SSDEEP

      3072:RnW15JigWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIp7WMHs:RKqqel7oe4nmOXouZq8XJa5Ga

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Downloads MZ/PE file

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks