dridex | hxxp://magickpeoplenew[.]xyz/ | Triage

Submit
Reports

Overview

overview

Static

static

URLScan

urlscan

http://magickpeoplen...

windows10_x64

Resubmissions

02-06-2021 08:33

210602-ft6tcnm7l6 10

31-05-2021 23:55

210531-sga8xmymq2 1

Sharing

General

Target

http://magickpeoplenew.xyz/
Sample

210602-ft6tcnm7l6

Score

10^/10

dridex 10111 botnet cryptone discovery evasion packer trojan

Static task

static1

URLScan task

urlscan1

Sample

http://magickpeoplenew.xyz/

Behavioral task

behavioral1

Sample

http://magickpeoplenew.xyz/

Resource

win10v20210410

dridex 10111 botnet cryptone discovery evasion packer trojan

windows10_x64

0 signatures

0 seconds

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

162.214.106.107:13783

46.231.204.10:8172

rc4.plain

rc4.plain

Targets

- Target
  
  http://magickpeoplenew.xyz/
Score

10^/10

dridex 10111 botnet cryptone discovery evasion packer trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- CryptOne packer
  Detects CryptOne packer defined in NCC blogpost.
  cryptone packer
- Blocklisted process makes network request
- Executes dropped EXE
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

urlscan1

behavioral1

dridex10111botnetcryptonediscoveryevasionpackertrojan

© 2018-2024

Terms | Privacy