General

  • Target

    a2b8c412265fd86ad9d10c64dd5e59baa52da0a1144547bbeffcf557dff360a0

  • Size

    565KB

  • Sample

    250220-hrkrcayqgj

  • MD5

    39f681fc5df4340af3b260acaa1539ff

  • SHA1

    ec0ea822da2bb7d5405472ebd96635554f364b4b

  • SHA256

    a2b8c412265fd86ad9d10c64dd5e59baa52da0a1144547bbeffcf557dff360a0

  • SHA512

    4e15ca257bd409b8f6f6d385748d7450dc191031df1ae5f4c54ef30841c7ad45b8d20a41b4a6bfc74109197c56fc41f7e2333c78eef8282acfcf452944912377

  • SSDEEP

    3072:Z7xg5WWbirNfJgWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRg:RrNffqel7oe4nmOXouZq9XJa5Ga

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

162.241.44.26:9443

185.184.25.234:4664

138.201.138.91:3389

rc4.plain
rc4.plain

Targets

    • Target

      a2b8c412265fd86ad9d10c64dd5e59baa52da0a1144547bbeffcf557dff360a0

    • Size

      565KB

    • MD5

      39f681fc5df4340af3b260acaa1539ff

    • SHA1

      ec0ea822da2bb7d5405472ebd96635554f364b4b

    • SHA256

      a2b8c412265fd86ad9d10c64dd5e59baa52da0a1144547bbeffcf557dff360a0

    • SHA512

      4e15ca257bd409b8f6f6d385748d7450dc191031df1ae5f4c54ef30841c7ad45b8d20a41b4a6bfc74109197c56fc41f7e2333c78eef8282acfcf452944912377

    • SSDEEP

      3072:Z7xg5WWbirNfJgWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRg:RrNffqel7oe4nmOXouZq9XJa5Ga

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks