DRIDEX IOCs

DRIDEX IOCs:

FTP URLs:
ftp://{redacted}:{redacted}@www.emtech-canada[.]com/docs
ftp://{redacted}:{redacted}@basedow-bilder[.]de/httpdocs/docs
ftp://{redacted}:{redacted}@charter-base[.]de/httpdocs/docs
ftp://{redacted}:{redacted}@peopleiknow[.]org/httpdocs/docs
ftp://{redacted}:{redacted}@schwellenwertdaten[.]de/httpdocs/docs/
ftp://{redacted}:{redacted}@motifahsap[.]com/httpdocs/docs
ftp://{redacted}:{redacted}@basedow-bilder[.]de/httpdocs/docs/scan_17.01.doc
ftp://{redacted}:{redacted}@www.emtech-canada[.]com/docs/scan_17.01.doc
ftp://{redacted}:{redacted}@motifahsap[.]com/httpdocs/docs/scan_17.01.doc
ftp://{redacted}:{redacted}@charter-base[.]de/httpdocs/docs/scan_17.01.xls
ftp://{redacted}:{redacted}@basedow-bilder[.]de/httpdocs/docs/scan_17.01.xls
ftp://{redacted}:{redacted}@www.emtech-canada[.]com/docs/scan_17.01.xls
ftp://{redacted}:{redacted}@charter-base[.]de/httpdocs/docs/scan_17.01.doc
ftp://{redacted}:{redacted}@motifahsap[.]com/httpdocs/docs/scan_17.01.xls
ftp://{redacted}:{redacted}@schwellenwertdaten[.]de/httpdocs/docs/scan_17.01.doc
ftp://{redacted}:{redacted}@schwellenwertdaten[.]de/httpdocs/docs/scan_17.01.xls
ftp://{redacted}:{redacted}@peopleiknow[.]org/httpdocs/docs/scan_17.01.xls
ftp://{redacted}:{redacted}@peopleiknow[.]org/httpdocs/docs/scan_17.01.doc
XLS Macro (SHA1):
5697b0e3123b7d9511568d153e5545eb0ec5c906
a1843ecc6f0c3f3fe0a3ef13d81d69abfaf6d4c9
7b7cdd64f0e66776303b4c09eefbac23471a58f1
DOC DDE Abuse (SHA1):
e6347d6245308e104a1f4225cdd2c814cff1a63a
Dridex Download Locations:
theairlab[.]co.za/KJHdey3
185.176.221[.]146
Dridex (SHA1):
23b84ed99d9761ce4ffdf928e472ee03afb3615f
Dridex C2s:
69.90.132[.]196:443
89.171.146[.]30:4143
108.166.114[.]38:4443
138.197.255[.]18:4143