General

  • Target

    322b876d63b85bc49dde46c661af1bcc72f2a343a58514aec1d097e249efa4db.exe

  • Size

    671KB

  • Sample

    250224-lbhtlasnft

  • MD5

    767124949dc18b6c05b58048918cfa19

  • SHA1

    33e76d3ee1ae1fe2cdff0f3db5b15d670e12afa7

  • SHA256

    322b876d63b85bc49dde46c661af1bcc72f2a343a58514aec1d097e249efa4db

  • SHA512

    92ddadb1405d197236fbe271c3f7610416c1da4d0376a99f16a7b6d8c366910d9570830c69587cddc4fa2981b1b419b11e70799d0ca0f205d68c089da77efeb4

  • SSDEEP

    12288:UYdfTGnYdfTGtsgqZXoYXMHGy1HxHFvja1E+YzVQ7aQEwhD942:UYdbyYdb6u3XMHGy1JFvuYzPSe2

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

5.9.178.143:443

37.139.2.140:3889

49.212.179.180:3889

69.64.62.4:4443

rc4.plain
rc4.plain

Targets

    • Target

      322b876d63b85bc49dde46c661af1bcc72f2a343a58514aec1d097e249efa4db.exe

    • Size

      671KB

    • MD5

      767124949dc18b6c05b58048918cfa19

    • SHA1

      33e76d3ee1ae1fe2cdff0f3db5b15d670e12afa7

    • SHA256

      322b876d63b85bc49dde46c661af1bcc72f2a343a58514aec1d097e249efa4db

    • SHA512

      92ddadb1405d197236fbe271c3f7610416c1da4d0376a99f16a7b6d8c366910d9570830c69587cddc4fa2981b1b419b11e70799d0ca0f205d68c089da77efeb4

    • SSDEEP

      12288:UYdfTGnYdfTGtsgqZXoYXMHGy1HxHFvja1E+YzVQ7aQEwhD942:UYdbyYdb6u3XMHGy1JFvuYzPSe2

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks