dridex | 1b3b31ac5700ab49d65a7bcf7d95b9028f7c322a0fa0f2af8670cfec552cdab6 | Triage

Submit
Reports

Overview

overview

Static

static

1b3b31ac57...b6.dll

windows7_x64

1b3b31ac57...b6.dll

windows10_x64

Sharing

General

Target

1b3b31ac5700ab49d65a7bcf7d95b9028f7c322a0fa0f2af8670cfec552cdab6
Size

188KB
Sample

210303-t322gt4pp6
MD5

f333d3fe94acc137e9276ef387e8e685
SHA1

2b7fe094e4741fb347b64b4467666528fc4d0c4d
SHA256

1b3b31ac5700ab49d65a7bcf7d95b9028f7c322a0fa0f2af8670cfec552cdab6
SHA512

210668924d392ca45d67c13f1f11e12cadb497309602908d222824a76a49d706368bd1001d975b6441e7185cc3282b1d1cf05b20056e77704b64b19bc5c5a312

Score

10^/10

dridex 111 botnet discovery evasion loader trojan

Static task

static1

Behavioral task

behavioral1

Sample

1b3b31ac5700ab49d65a7bcf7d95b9028f7c322a0fa0f2af8670cfec552cdab6.dll

Resource

win7v20201028

dridex 111 botnet discovery evasion loader trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

1b3b31ac5700ab49d65a7bcf7d95b9028f7c322a0fa0f2af8670cfec552cdab6.dll

Resource

win10v20201028

dridex 111 botnet discovery evasion loader trojan

windows10_x64

0 signatures

0 seconds

Malware Config

Extracted

Family

dridex

Botnet

111

C2

116.251.211.158:443

216.10.242.142:6601

37.247.35.137:6601

rc4.plain

rc4.plain

Targets

- Target
  
  1b3b31ac5700ab49d65a7bcf7d95b9028f7c322a0fa0f2af8670cfec552cdab6
- Size
  
  188KB
- MD5
  
  f333d3fe94acc137e9276ef387e8e685
- SHA1
  
  2b7fe094e4741fb347b64b4467666528fc4d0c4d
- SHA256
  
  1b3b31ac5700ab49d65a7bcf7d95b9028f7c322a0fa0f2af8670cfec552cdab6
- SHA512
  
  210668924d392ca45d67c13f1f11e12cadb497309602908d222824a76a49d706368bd1001d975b6441e7185cc3282b1d1cf05b20056e77704b64b19bc5c5a312
Score

10^/10

dridex 111 botnet discovery evasion loader trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Loader
  Detects Dridex both x86 and x64 loader in memory.
  botnet loader
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dridex111botnetdiscoveryevasionloadertrojan

behavioral2

dridex111botnetdiscoveryevasionloadertrojan

© 2018-2024

Terms | Privacy