dridex

General

Target
0c05f90aa40d2a6a3dec2d3bcc5abea8d47058930edf8f80daa2058923f92819
Size 657KB
Sample201113-ydgcp3bmca
SHA256 0c05f90aa40d2a6a3dec2d3bcc5abea8d47058930edf8f80daa2058923f92819
MD5 414dc6341c5fb55a52cbc7bbd02f5549
SHA1 637f85dc0411e0367deb2eda3deca0dbe949fef7
SHA512 b4f809bea77486ec09415bcc41fc21c81216bd3107a5d28c9347d282bb32710d55ee087c280fd3a3c63fccc6170fc2de3c7a3878e7bf903055ff264533abfc24
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

194.150.118.7:443
49.212.179.180:3889
69.64.62.4:4443

rc4.plain

Targets

- Target
  0c05f90aa40d2a6a3dec2d3bcc5abea8d47058930edf8f80daa2058923f92819
- Size 657KB
- SHA256 0c05f90aa40d2a6a3dec2d3bcc5abea8d47058930edf8f80daa2058923f92819
- MD5 414dc6341c5fb55a52cbc7bbd02f5549
- SHA1 637f85dc0411e0367deb2eda3deca0dbe949fef7
- SHA512 b4f809bea77486ec09415bcc41fc21c81216bd3107a5d28c9347d282bb32710d55ee087c280fd3a3c63fccc6170fc2de3c7a3878e7bf903055ff264533abfc24
- MD5 SHA1 SHA512
Score

10^/10

dridex 10111 botnet discovery evasion loader trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Loader
  Detects Dridex both x86 and x64 loader in memory.
  botnet loader
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Dridex Loader

Checks installed software on the system

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2