General

  • Target

    8fcb313403e05ff1927c8389d1f392d8b302ffd07ad85ab54272a26707c90114

  • Size

    1.4MB

  • Sample

    250222-k2zpcsvkx2

  • MD5

    2a48f458dc9952b760862b105a556a10

  • SHA1

    073f16803eb7600ae685d6a4b28acc6f25fc14f0

  • SHA256

    8fcb313403e05ff1927c8389d1f392d8b302ffd07ad85ab54272a26707c90114

  • SHA512

    0c71aec05cbe0593287c8a41308d7d0d7398f5a54cf45d2fd271cb368cf578fc913eeb5e81b71ecdb184c6b90feacb6c631913d1df46a135b37fa6e810339923

  • SSDEEP

    3072:sxSm9vz5ZNgWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNx7lxCJo:aZvfjqel7oe4nmOXouZrPu9Ga

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

97.107.127.227:443

87.106.18.216:5037

185.184.25.235:5037

rc4.plain
rc4.plain

Targets

    • Target

      8fcb313403e05ff1927c8389d1f392d8b302ffd07ad85ab54272a26707c90114

    • Size

      1.4MB

    • MD5

      2a48f458dc9952b760862b105a556a10

    • SHA1

      073f16803eb7600ae685d6a4b28acc6f25fc14f0

    • SHA256

      8fcb313403e05ff1927c8389d1f392d8b302ffd07ad85ab54272a26707c90114

    • SHA512

      0c71aec05cbe0593287c8a41308d7d0d7398f5a54cf45d2fd271cb368cf578fc913eeb5e81b71ecdb184c6b90feacb6c631913d1df46a135b37fa6e810339923

    • SSDEEP

      3072:sxSm9vz5ZNgWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNx7lxCJo:aZvfjqel7oe4nmOXouZrPu9Ga

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks