dridex

General

Target
tdskvr4y6.rar.dll
Size 525KB
Sample201210-76k8p1xkte
SHA256 9e7b660bda0c8106ff7345d4bae214da27f542f7f81fa1df61ce82cc6a6825cc
MD5 3de3cc4de83ab13b16b089e9ccbebeba
SHA1 36edc752c8d0cbe4eaf15f0de56ef46084fb8672
SHA512 4e2d427da8a89d641bafd5cae6169fdc24c3c2c473ca54b7bd6b6d61fa9dccd732cad0e05630711de09d219672c1b4308ca6282f9a0390e77a53afb8a555a722
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

169.255.216.36:443
138.201.138.91:3389
89.174.36.41:4643
87.106.89.36:3389

rc4.plain

Targets

- Target
  tdskvr4y6.rar.dll
- Size 525KB
- SHA256 9e7b660bda0c8106ff7345d4bae214da27f542f7f81fa1df61ce82cc6a6825cc
- MD5 3de3cc4de83ab13b16b089e9ccbebeba
- SHA1 36edc752c8d0cbe4eaf15f0de56ef46084fb8672
- SHA512 4e2d427da8a89d641bafd5cae6169fdc24c3c2c473ca54b7bd6b6d61fa9dccd732cad0e05630711de09d219672c1b4308ca6282f9a0390e77a53afb8a555a722
- MD5 SHA1 SHA512
Score

10^/10

dridex 10444 botnet discovery evasion loader trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Loader
  Detects Dridex both x86 and x64 loader in memory.
  botnet loader
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Dridex Loader

Blocklisted process makes network request

Checks installed software on the system

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2