Dridex

Originaly found by http://pastebin.com/u/benkow_

C&C:
https://privedmidved.net/content/webanalyser/bnp/admin/
https://avsmartchk.com/cgi-bin/index/ctcrm5.pl
https://avsmartchk.com/cgi-bin/index/ctcrm5.pl
https://avsmartchk.com/web/gate.php
https://avsmartchk.com/web/body http://pastebin.com/A8EkKep6

var BOTID = "BOT_MACHINE_UUID"

targets:
https://professionnels.secure.societegenerale.fr/ / https://*entreprises*societegenerale.fr* -> inject https://avsmartchk.com/data/main52sgp.js (http://pastebin.com/3gdHxZiM) / https://avsmartchk.com/data/main52sgp_bal.js (http://pastebin.com/3nYVA3u4)

http*coopanet.com* -> inject https://avsmartchk.com/data/main43coo.js (http://pastebin.com/TqmJ55E9)

http*btpnet.tm.fr* -> inject https://avsmartchk.com/data/main43btp.js (http://pastebin.com/k6u0x4eZ)

http*entreprises.bnpparibas.net -> inject https://avsmartchk.com/data/main51bnp.js (http://pastebin.com/TqmJ55E9)

http*p.test.com -> inject https://avsmartchk.com/data/main51bnp.js (http://pastebin.com/TqmJ55E9)

http*cdc-net.com/* -> inject https://avsmartchk.com/data/main41cd.js (http://pastebin.com/qJWBECXX)

http*://*.creditmutuel.fr* -> inject https://avsmartchk.com/data/main42crm.js (http://pastebin.com/SJ9uDPLe)

https://*secure.lcl.fr* -> inject https://privedmidved.net/lc/menu.js (http://pastebin.com/DzjD8kVN)

https*cic.fr*