dridex | 0ae09aa6c01a64e121af0d0c1a91c32d9e232e3d1334a83b90e5b36702426a4e | Triage

Sharing

General

Target

0ae09aa6c01a64e121af0d0c1a91c32d9e232e3d1334a83b90e5b36702426a4e
Size

168KB
Sample

210304-p1gb8vnp7e
MD5

7b5079631af6063161abebaab19517b6
SHA1

f385dc8db60e53e960010d19d66432f1a6222702
SHA256

0ae09aa6c01a64e121af0d0c1a91c32d9e232e3d1334a83b90e5b36702426a4e
SHA512

19db6575231927d1ff4b02943a5d14f311093bd864521b840bb3122dfc61eb3b2017c07f5dc88db3631537854bb6d0010c37074983f77c80e575656aa0383868

Score

10^/10

dridex 111 botnet discovery evasion loader trojan

Malware Config

Extracted

Family

dridex

Botnet

111

C2

173.203.78.138:443

217.160.107.189:6601

77.220.64.150:5037

rc4.plain

rc4.plain

Targets

- Target
  
  0ae09aa6c01a64e121af0d0c1a91c32d9e232e3d1334a83b90e5b36702426a4e
- Size
  
  168KB
- MD5
  
  7b5079631af6063161abebaab19517b6
- SHA1
  
  f385dc8db60e53e960010d19d66432f1a6222702
- SHA256
  
  0ae09aa6c01a64e121af0d0c1a91c32d9e232e3d1334a83b90e5b36702426a4e
- SHA512
  
  19db6575231927d1ff4b02943a5d14f311093bd864521b840bb3122dfc61eb3b2017c07f5dc88db3631537854bb6d0010c37074983f77c80e575656aa0383868
Score

10^/10

dridex 111 botnet discovery evasion loader trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Loader
  Detects Dridex both x86 and x64 loader in memory.
  botnet loader
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

dridex111botnetdiscoveryevasionloadertrojan