dridex

General

Target
z3r5hq.rar.dll
Size 562KB
Sample210201-rwmd85bkaj
SHA256 3a4bd219435b2324b3976dbb7b90789aa4a5cb17567bc6a7129d1e73bfaaa413
MD5 fe79842c3c12b448efb747b370f9605a
SHA1 bb2a3dc9babae6520082feadedf871163fcb19a8
SHA512 1226b30fc38f8fdb7e94e8830eb814d3d81711ac42bdf23a4b54ff058b57c9faf2be287e98a7e64287b7b6532072fdf00e1456f099ff6f0cfa6eceb5b02c5f3b
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

77.220.64.131:443
5.196.204.251:5037
192.99.41.136:981
24.229.3.146:4664

rc4.plain

Targets

- Target
  z3r5hq.rar.dll
- Size 562KB
- SHA256 3a4bd219435b2324b3976dbb7b90789aa4a5cb17567bc6a7129d1e73bfaaa413
- MD5 fe79842c3c12b448efb747b370f9605a
- SHA1 bb2a3dc9babae6520082feadedf871163fcb19a8
- SHA512 1226b30fc38f8fdb7e94e8830eb814d3d81711ac42bdf23a4b54ff058b57c9faf2be287e98a7e64287b7b6532072fdf00e1456f099ff6f0cfa6eceb5b02c5f3b
- MD5 SHA1 SHA512
Score

10^/10

dridex 10444 botnet discovery evasion loader trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Loader
  Detects Dridex both x86 and x64 loader in memory.
  botnet loader
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Dridex Loader

Blocklisted process makes network request

Checks installed software on the system

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2