General

  • Target

    bfa8567fa9a151b0fa85d7aa570004f69753bb7d8ecd5ae0f829c7b6c4110de1

  • Size

    1.4MB

  • Sample

    250219-grfa7a1ky3

  • MD5

    70b8696e50f0eb7c1f20b41597df1f4b

  • SHA1

    bb5ae79d6f5a80cfe6b562028b639d4d82057019

  • SHA256

    bfa8567fa9a151b0fa85d7aa570004f69753bb7d8ecd5ae0f829c7b6c4110de1

  • SHA512

    bf023163acd725f4276e6707f1bfa524f162ae2c9d2d2e35695ff8c675bd953941b6c19817b848f610c616ca9e710f5b12b41ae956e4e6d31d25ce396876a95d

  • SSDEEP

    3072:d4R69rv5hNgWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNx7lxCJm:Sarzjqel7oe4nmOXouZrPu48Go

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

97.107.127.227:443

87.106.18.216:5037

185.184.25.235:5037

rc4.plain
rc4.plain

Targets

    • Target

      bfa8567fa9a151b0fa85d7aa570004f69753bb7d8ecd5ae0f829c7b6c4110de1

    • Size

      1.4MB

    • MD5

      70b8696e50f0eb7c1f20b41597df1f4b

    • SHA1

      bb5ae79d6f5a80cfe6b562028b639d4d82057019

    • SHA256

      bfa8567fa9a151b0fa85d7aa570004f69753bb7d8ecd5ae0f829c7b6c4110de1

    • SHA512

      bf023163acd725f4276e6707f1bfa524f162ae2c9d2d2e35695ff8c675bd953941b6c19817b848f610c616ca9e710f5b12b41ae956e4e6d31d25ce396876a95d

    • SSDEEP

      3072:d4R69rv5hNgWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNx7lxCJm:Sarzjqel7oe4nmOXouZrPu48Go

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks