General

  • Target

    9cecebbf05a372db0cc7c30f2ed0c7077c7747e13819735b128361dc92eb4dca

  • Size

    1.1MB

  • Sample

    250404-hcw6ts1ygx

  • MD5

    4ccd7b44a646915b83e689d0d778c5c7

  • SHA1

    fe1195ee74b0d935ae3f11681074ca1fb3bf86fa

  • SHA256

    9cecebbf05a372db0cc7c30f2ed0c7077c7747e13819735b128361dc92eb4dca

  • SHA512

    49e577c62db1297bfdf321ab9c5b5f67b0f866eaedc64d07bd830462300e4925a64616f8c1ec1094bc284d7607e9d79f8530646fc325573d541317784ea95a24

  • SSDEEP

    3072:hbW15JigWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIpTWMHs:hWqqel7oe4nmOXouZq0XJa5Ga

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

162.241.44.26:9443

185.184.25.234:4664

138.201.138.91:3389

rc4.plain
rc4.plain

Targets

    • Target

      9cecebbf05a372db0cc7c30f2ed0c7077c7747e13819735b128361dc92eb4dca

    • Size

      1.1MB

    • MD5

      4ccd7b44a646915b83e689d0d778c5c7

    • SHA1

      fe1195ee74b0d935ae3f11681074ca1fb3bf86fa

    • SHA256

      9cecebbf05a372db0cc7c30f2ed0c7077c7747e13819735b128361dc92eb4dca

    • SHA512

      49e577c62db1297bfdf321ab9c5b5f67b0f866eaedc64d07bd830462300e4925a64616f8c1ec1094bc284d7607e9d79f8530646fc325573d541317784ea95a24

    • SSDEEP

      3072:hbW15JigWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIpTWMHs:hWqqel7oe4nmOXouZq0XJa5Ga

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks