General

  • Target

    81dbb6e102bab3b5a12379519166a5bfed285054ad762e43eef51ecc87f65108

  • Size

    551KB

  • Sample

    250225-j7vrxszk18

  • MD5

    74871abdf70d247e830105d422cff236

  • SHA1

    2d0f353e1600ce2290f6a66f7227ceed82063227

  • SHA256

    81dbb6e102bab3b5a12379519166a5bfed285054ad762e43eef51ecc87f65108

  • SHA512

    23ff975cbc1afc8959008259ed5e8734bef6121a0577c13c0ebb2cdbed2e848e32c1ffcf3aa1878a95096495892c215b508724399c627ca52b47fc021a00ddb6

  • SSDEEP

    3072:gY3rkgWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIpnWMHmIY:FYqel7oe4nmOXouZq4XJa5Ga

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

162.241.44.26:9443

185.184.25.234:4664

138.201.138.91:3389

rc4.plain
rc4.plain

Targets

    • Target

      81dbb6e102bab3b5a12379519166a5bfed285054ad762e43eef51ecc87f65108

    • Size

      551KB

    • MD5

      74871abdf70d247e830105d422cff236

    • SHA1

      2d0f353e1600ce2290f6a66f7227ceed82063227

    • SHA256

      81dbb6e102bab3b5a12379519166a5bfed285054ad762e43eef51ecc87f65108

    • SHA512

      23ff975cbc1afc8959008259ed5e8734bef6121a0577c13c0ebb2cdbed2e848e32c1ffcf3aa1878a95096495892c215b508724399c627ca52b47fc021a00ddb6

    • SSDEEP

      3072:gY3rkgWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIpnWMHmIY:FYqel7oe4nmOXouZq4XJa5Ga

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks