Description
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
j4r7zap
General
Target
Size
Sample
j4r7zap
539KB
201119-g2vmpr2nqj
Score
10 /10
MD5
SHA1
SHA256
SHA512
19473a4823afb3ca1c966ffed1ee6003
db853d8f738ee15172141315e96644bf6f265d6b
7359fb03e09c8416c7a967f72df483a1b60066434c9e49e0deb4b18cb11e9192
850fbc3ae33fa2d36fb4ecd7d06487be6dc1e382e7228faf1648b53e7c0d99ef9724b7578b1aaa42f97b53f2b60497737d14033e2deb09f38d838e7f2aa065cd
Malware Config
Extracted
| Family | dridex |
| Botnet | 10555 |
| C2 |
162.241.44.26:9443 192.232.229.53:4443 77.220.64.34:443 193.90.12.121:3098 |
| rc4.plain |
|
| rc4.plain |
|
Targets
Target
MD5
Filesize
j4r7zap
19473a4823afb3ca1c966ffed1ee6003
539KB
Score
10 /10
SHA1
SHA256
SHA512
db853d8f738ee15172141315e96644bf6f265d6b
7359fb03e09c8416c7a967f72df483a1b60066434c9e49e0deb4b18cb11e9192
850fbc3ae33fa2d36fb4ecd7d06487be6dc1e382e7228faf1648b53e7c0d99ef9724b7578b1aaa42f97b53f2b60497737d14033e2deb09f38d838e7f2aa065cd
Tags
Signatures
-
Dridex
-
Dridex Loader
Description
Detects Dridex both x86 and x64 loader in memory.
Tags
-
Blocklisted process makes network request
-
Checks installed software on the system
Description
Looks up Uninstall key entries in the registry to enumerate software on the system.
Tags
TTPs
-
Checks whether UAC is enabled
Tags
TTPs
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks