dridex

General

Target
g0gs7vm7arar
Size 538KB
Sample201209-mk8me5znve
SHA256 d70b63c7a5b91b82058eeacd29ecc94cd7b3d23ec1cd80afb958843563ef7f62
MD5 88b2090c990ad3705e43397f974c0597
SHA1 639de58486cdfb5f97169d5a032fd3fd4e63a7d0
SHA512 65705cf9e7d4e452a3b9d4cbbf5f3163f9e7d60e1310f37c96f22f26ee5947cdc6c7896a38362be610e1fe92c77fe7ed96e9330a1c708a7267c610e2c4ee0da5
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

169.255.216.36:443
138.201.138.91:3389
89.174.36.41:4643
87.106.89.36:3389

rc4.plain

Targets

- Target
  g0gs7vm7arar
- Size 538KB
- SHA256 d70b63c7a5b91b82058eeacd29ecc94cd7b3d23ec1cd80afb958843563ef7f62
- MD5 88b2090c990ad3705e43397f974c0597
- SHA1 639de58486cdfb5f97169d5a032fd3fd4e63a7d0
- SHA512 65705cf9e7d4e452a3b9d4cbbf5f3163f9e7d60e1310f37c96f22f26ee5947cdc6c7896a38362be610e1fe92c77fe7ed96e9330a1c708a7267c610e2c4ee0da5
- MD5 SHA1 SHA512
Score

10^/10

dridex 10444 botnet discovery evasion loader trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Loader
  Detects Dridex both x86 and x64 loader in memory.
  botnet loader
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Dridex Loader

Blocklisted process makes network request

Checks installed software on the system

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2