dridex | 4e8dff1283b2a4b1def208ba37e7cd1ff2b9392dc267eac8ae99e5277a9c73a2 | Triage

Sharing

General

Target

4e8dff1283b2a4b1def208ba37e7cd1ff2b9392dc267eac8ae99e5277a9c73a2
Size

188KB
Sample

210303-gwcdwdzbyj
MD5

9a9fa28e95c756676c167a9003b7c83c
SHA1

d2d965c096c5644ac7e5f3d0f1b5a03f69e3b7c6
SHA256

4e8dff1283b2a4b1def208ba37e7cd1ff2b9392dc267eac8ae99e5277a9c73a2
SHA512

bde0c8b9df4aea86e58c9bc950963386826fd5b0329ab04e75a02b3b31e524a1d115600175adf3cdcf86c05691b2dfccec5faa3c8c6858c81db1e3bc001786e1

Score

10^/10

dridex 111 botnet discovery evasion loader trojan

Malware Config

Extracted

Family

dridex

Botnet

111

C2

116.251.211.158:443

216.10.242.142:6601

37.247.35.137:6601

rc4.plain

rc4.plain

Targets

- Target
  
  4e8dff1283b2a4b1def208ba37e7cd1ff2b9392dc267eac8ae99e5277a9c73a2
- Size
  
  188KB
- MD5
  
  9a9fa28e95c756676c167a9003b7c83c
- SHA1
  
  d2d965c096c5644ac7e5f3d0f1b5a03f69e3b7c6
- SHA256
  
  4e8dff1283b2a4b1def208ba37e7cd1ff2b9392dc267eac8ae99e5277a9c73a2
- SHA512
  
  bde0c8b9df4aea86e58c9bc950963386826fd5b0329ab04e75a02b3b31e524a1d115600175adf3cdcf86c05691b2dfccec5faa3c8c6858c81db1e3bc001786e1
Score

10^/10

dridex 111 botnet discovery evasion loader trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Loader
  Detects Dridex both x86 and x64 loader in memory.
  botnet loader
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2

dridex111botnetdiscoveryevasionloadertrojan