General

  • Target

    27ac4e5e244058ca5743fe7809b6fb9d37cb6557ef0597fcc8f0990a76751967

  • Size

    554KB

  • Sample

    250218-hxh5pszly6

  • MD5

    0cb6cd703a4fe22d60e610345929436f

  • SHA1

    a326114041ee99803fef6673621c94bd29676e5e

  • SHA256

    27ac4e5e244058ca5743fe7809b6fb9d37cb6557ef0597fcc8f0990a76751967

  • SHA512

    f836572851c5f0b8872a38bd2948776520b2c7db831117ea72531c62fa491e667d47af32d35cac9ef906cca7ea510d0d7e9f42b8a95e9c95410b9379574152b7

  • SSDEEP

    3072:LaG5WJ0gWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIpop9Wn:coqel7oe4nmOXouZqWpsXJa5Ga

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

162.241.44.26:9443

185.184.25.234:4664

138.201.138.91:3389

rc4.plain
rc4.plain

Targets

    • Target

      27ac4e5e244058ca5743fe7809b6fb9d37cb6557ef0597fcc8f0990a76751967

    • Size

      554KB

    • MD5

      0cb6cd703a4fe22d60e610345929436f

    • SHA1

      a326114041ee99803fef6673621c94bd29676e5e

    • SHA256

      27ac4e5e244058ca5743fe7809b6fb9d37cb6557ef0597fcc8f0990a76751967

    • SHA512

      f836572851c5f0b8872a38bd2948776520b2c7db831117ea72531c62fa491e667d47af32d35cac9ef906cca7ea510d0d7e9f42b8a95e9c95410b9379574152b7

    • SSDEEP

      3072:LaG5WJ0gWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIpop9Wn:coqel7oe4nmOXouZqWpsXJa5Ga

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks