dridex

General

Target
s5kh50rfbzip
Size 538KB
Sample201209-s9d98ry666
SHA256 d1246b6a477f067776d2d64a193da27f297332ae565ee2aff3cb143c3c02a9fb
MD5 208ea18a1c208b72527dfda07853eb9d
SHA1 4b616711270f7c419a7eabed9636069454a5324e
SHA512 0795552ddbaf95071a297346a1d9e3d4fc1cb734cbd52e7af3d5f2cd0310139f5aa5ca6aff6ea656d2adee14401519858348b966a4bb4d4c5b088ebc05382c16
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

169.255.216.36:443
138.201.138.91:3389
89.174.36.41:4643
87.106.89.36:3389

rc4.plain

Targets

- Target
  s5kh50rfbzip
- Size 538KB
- SHA256 d1246b6a477f067776d2d64a193da27f297332ae565ee2aff3cb143c3c02a9fb
- MD5 208ea18a1c208b72527dfda07853eb9d
- SHA1 4b616711270f7c419a7eabed9636069454a5324e
- SHA512 0795552ddbaf95071a297346a1d9e3d4fc1cb734cbd52e7af3d5f2cd0310139f5aa5ca6aff6ea656d2adee14401519858348b966a4bb4d4c5b088ebc05382c16
- MD5 SHA1 SHA512
Score

10^/10

dridex 10444 botnet discovery evasion loader trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Loader
  Detects Dridex both x86 and x64 loader in memory.
  botnet loader
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Dridex Loader

Blocklisted process makes network request

Checks installed software on the system

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2