dridex

General

Target
55971da79963e4e1ac94533e9097dc48c9d9f3e8903ffcd3146ad92b6a8e7ed2
Size 188KB
Sample210224-9sr97h7s2x
SHA256 55971da79963e4e1ac94533e9097dc48c9d9f3e8903ffcd3146ad92b6a8e7ed2
MD5 f50a2fc77bda39064ac8a104ea12160d
SHA1 40230488500aebe9753e66658f6959340acea38f
SHA512 c9e3ae8e028733a1090fecff8be48c6c74a7d99259f1825220024e72077c6630a9d67da53ad744c82fd47b4a953df9341d27cce44ababd2410dffa3556d3ba13
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

dridex

Botnet

111

C2

209.151.236.42:443
91.121.94.86:8172
5.189.144.136:6516

rc4.plain

Targets

- Target
  55971da79963e4e1ac94533e9097dc48c9d9f3e8903ffcd3146ad92b6a8e7ed2
- Size 188KB
- SHA256 55971da79963e4e1ac94533e9097dc48c9d9f3e8903ffcd3146ad92b6a8e7ed2
- MD5 f50a2fc77bda39064ac8a104ea12160d
- SHA1 40230488500aebe9753e66658f6959340acea38f
- SHA512 c9e3ae8e028733a1090fecff8be48c6c74a7d99259f1825220024e72077c6630a9d67da53ad744c82fd47b4a953df9341d27cce44ababd2410dffa3556d3ba13
- MD5 SHA1 SHA512
Score

10^/10

dridex 111 botnet discovery evasion loader trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Loader
  Detects Dridex both x86 and x64 loader in memory.
  botnet loader
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Dridex Loader

Blocklisted process makes network request

Checks installed software on the system

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2