dridex

General

Target
yh0aj4z[1].pdf.zip
Size 263KB
Sample201112-e66449gfaj
SHA256 b271b962d79730c73596a8881eb02727736820bb6cd8071c8d81e6d4dc7a951e
MD5 41132dd8be83afdedf51befdb5c6870e
SHA1 aacb327d5eb7300340284b4d1f5562a0f6083dd0
SHA512 08fcd24540c25b0d89e6e437e1325887e645c71a8d60d2e35fabbe04f98399190c4b9b9d2708aeeb96af964eec2729dbaf1b126e6ee1ea049e0de99fd1c9c8a5
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

77.220.64.39:443
69.164.207.140:3388
78.47.139.43:4443
103.244.206.74:33443

rc4.plain

Targets

- Target
  yh0aj4z[1].pdf
- Size 556KB
- SHA256 d7093640c50ebce8ea387148099bb0e30c9387d2748f728f10398dfd4e365450
- MD5 ee69629c63e45daebdd031f840562b34
- SHA1 302b7da0d9472c75869d6c48eee9fb6b652dc618
- SHA512 43033b847b28c5781b65d18a8ba898a6572b5b687b46ac03318604ee9e8aad6964f723265bb1375eecc0b66a411955823540661e1e2c3da29466a060804a5419
- MD5 SHA1 SHA512
Score

10^/10

dridex 10444 botnet discovery evasion loader trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Loader
  Detects Dridex both x86 and x64 loader in memory.
  botnet loader
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Dridex Loader

Blocklisted process makes network request

Checks installed software on the system

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2