General

  • Target

    53de1377a8c475cb185ea93113c35ec7c1941fb89d1a2682757dfe25a19bd472

  • Size

    1.3MB

  • Sample

    250225-jsrrqayl17

  • MD5

    1e442a3ef1d37c8adf2f89d2afb5cb75

  • SHA1

    7663bfcf885705b6f4752c92dd312d2504518cef

  • SHA256

    53de1377a8c475cb185ea93113c35ec7c1941fb89d1a2682757dfe25a19bd472

  • SHA512

    61ca51d4f63506b1f3e0987dc504c66a9c1eb49afc918427b8d5eae65e983a6addedceb79c7f001280ac4945e060ae48711ecf4a242ea53933b9e29ce9f2ed3d

  • SSDEEP

    6144:yXOT+RDQ/0jnNESgfcDLd9a5tLQDB6FgD6b/3nE8FfcMkIUv0Go:cOT+RbjmedytLJFA6T3nE8FsIF

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

51.68.224.245:4646

188.165.17.91:8443

173.255.246.77:691

rc4.plain
rc4.plain

Targets

    • Target

      53de1377a8c475cb185ea93113c35ec7c1941fb89d1a2682757dfe25a19bd472

    • Size

      1.3MB

    • MD5

      1e442a3ef1d37c8adf2f89d2afb5cb75

    • SHA1

      7663bfcf885705b6f4752c92dd312d2504518cef

    • SHA256

      53de1377a8c475cb185ea93113c35ec7c1941fb89d1a2682757dfe25a19bd472

    • SHA512

      61ca51d4f63506b1f3e0987dc504c66a9c1eb49afc918427b8d5eae65e983a6addedceb79c7f001280ac4945e060ae48711ecf4a242ea53933b9e29ce9f2ed3d

    • SSDEEP

      6144:yXOT+RDQ/0jnNESgfcDLd9a5tLQDB6FgD6b/3nE8FfcMkIUv0Go:cOT+RbjmedytLJFA6T3nE8FsIF

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks