dridex

General

Target
aeaf096c23423db8e453cafe05f2f2f28f2334f01a682e83ef4b6e59b99a7293
Size 188KB
Sample210224-1qpq4evdh6
SHA256 aeaf096c23423db8e453cafe05f2f2f28f2334f01a682e83ef4b6e59b99a7293
MD5 d44c885349c1fdab894faf9550979032
SHA1 96c02188ee31d8349bd553d71f70f2a1dd9392c1
SHA512 1a0291ec7155616a96f673e84d0a0523b405072d299d352ef1e52dd90d1bbaac185b721acb5b20716581d59a9d12c39d87d488b10cc7e9a350559ca0ef171dd4
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

dridex

Botnet

111

C2

209.151.236.42:443
91.121.94.86:8172
5.189.144.136:6516

rc4.plain

Targets

- Target
  aeaf096c23423db8e453cafe05f2f2f28f2334f01a682e83ef4b6e59b99a7293
- Size 188KB
- SHA256 aeaf096c23423db8e453cafe05f2f2f28f2334f01a682e83ef4b6e59b99a7293
- MD5 d44c885349c1fdab894faf9550979032
- SHA1 96c02188ee31d8349bd553d71f70f2a1dd9392c1
- SHA512 1a0291ec7155616a96f673e84d0a0523b405072d299d352ef1e52dd90d1bbaac185b721acb5b20716581d59a9d12c39d87d488b10cc7e9a350559ca0ef171dd4
- MD5 SHA1 SHA512
Score

10^/10

dridex 111 botnet discovery evasion loader trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Loader
  Detects Dridex both x86 and x64 loader in memory.
  botnet loader
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Dridex Loader

Blocklisted process makes network request

Checks installed software on the system

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2