General

  • Target

    ebe8ebc089a026b955ee00e969ee472379d95093c177b01eed57f5e8a94896f8

  • Size

    1.1MB

  • Sample

    250404-prvd4sypy2

  • MD5

    0ebee601987db9f9c5a0c4042bb9a134

  • SHA1

    692f555591be88a28b52d3c28b12555f6e1829fa

  • SHA256

    ebe8ebc089a026b955ee00e969ee472379d95093c177b01eed57f5e8a94896f8

  • SHA512

    9d5e1721e0442ee85664cc97e154ae6e08ea814e0c8c57b0cb0e5c55fe8d36c244fb4d37a3eb1541021879ce7d089ee121c2fb320c131f16857c84e62616a22c

  • SSDEEP

    3072:44UVgWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIp6WMHmIsx:qLqel7oe4nmOXouZqhXJa5Ga

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

162.241.44.26:9443

185.184.25.234:4664

138.201.138.91:3389

rc4.plain
rc4.plain

Targets

    • Target

      ebe8ebc089a026b955ee00e969ee472379d95093c177b01eed57f5e8a94896f8

    • Size

      1.1MB

    • MD5

      0ebee601987db9f9c5a0c4042bb9a134

    • SHA1

      692f555591be88a28b52d3c28b12555f6e1829fa

    • SHA256

      ebe8ebc089a026b955ee00e969ee472379d95093c177b01eed57f5e8a94896f8

    • SHA512

      9d5e1721e0442ee85664cc97e154ae6e08ea814e0c8c57b0cb0e5c55fe8d36c244fb4d37a3eb1541021879ce7d089ee121c2fb320c131f16857c84e62616a22c

    • SSDEEP

      3072:44UVgWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIp6WMHmIsx:qLqel7oe4nmOXouZqhXJa5Ga

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks