dridex | hxxps://exitmagall[.]xyz/iduew73 | Triage

Submit
Reports

Overview

overview

Static

static

URLScan

urlscan

https://exitmagall.x...

windows10_x64

Sharing

General

Target

https://exitmagall.xyz/iduew73
Sample

210603-7akx2jarsn

Score

10^/10

dridex 10111 botnet cryptone discovery evasion packer trojan

Static task

static1

URLScan task

urlscan1

Sample

https://exitmagall.xyz/iduew73

Behavioral task

behavioral1

Sample

https://exitmagall.xyz/iduew73

Resource

win10v20210408

dridex 10111 botnet cryptone discovery evasion packer trojan

windows10_x64

0 signatures

0 seconds

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

162.214.106.107:13783

46.231.204.10:8172

rc4.plain

rc4.plain

Targets

- Target
  
  https://exitmagall.xyz/iduew73
Score

10^/10

dridex 10111 botnet cryptone discovery evasion packer trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- CryptOne packer
  Detects CryptOne packer defined in NCC blogpost.
  cryptone packer
- Blocklisted process makes network request
- Executes dropped EXE
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

urlscan1

behavioral1

dridex10111botnetcryptonediscoveryevasionpackertrojan

© 2018-2024

Terms | Privacy