General

  • Target

    aded34d78775d27ecdec7a36406f0cf42a632ea85304b39923df94e63a6fabec

  • Size

    551KB

  • Sample

    250404-te6ntszwhv

  • MD5

    a0f0d55076cea36d83baa94ac78edf16

  • SHA1

    56b7ce6f230a61dd6376776f72caf1511a04a4a0

  • SHA256

    aded34d78775d27ecdec7a36406f0cf42a632ea85304b39923df94e63a6fabec

  • SHA512

    6c13d030ae39f7e501713f281abd3f65688e91c9ef06caa27c34972ad92ec2dc0ee42b1e0275de7fea6db55d0faaea2773c07ffaee97bf9e7ecac817025846cb

  • SSDEEP

    3072:e3q30gWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIpjWMHmIY:zoqel7oe4nmOXouZqIXJa5Ga

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

162.241.44.26:9443

185.184.25.234:4664

138.201.138.91:3389

rc4.plain
rc4.plain

Targets

    • Target

      aded34d78775d27ecdec7a36406f0cf42a632ea85304b39923df94e63a6fabec

    • Size

      551KB

    • MD5

      a0f0d55076cea36d83baa94ac78edf16

    • SHA1

      56b7ce6f230a61dd6376776f72caf1511a04a4a0

    • SHA256

      aded34d78775d27ecdec7a36406f0cf42a632ea85304b39923df94e63a6fabec

    • SHA512

      6c13d030ae39f7e501713f281abd3f65688e91c9ef06caa27c34972ad92ec2dc0ee42b1e0275de7fea6db55d0faaea2773c07ffaee97bf9e7ecac817025846cb

    • SSDEEP

      3072:e3q30gWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIpjWMHmIY:zoqel7oe4nmOXouZqIXJa5Ga

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks