dridex | 331d55def39d58b50770bb647db0b98ae3d049a11626c7a76e0008ad84fba620 | Triage

Sharing

General

Target

331d55def39d58b50770bb647db0b98ae3d049a11626c7a76e0008ad84fba620
Size

608KB
Sample

211014-hv9vmsgcgk
MD5

b8b4376c19a5cb6a2fe069441249bcf8
SHA1

5b7cbfb91c54484f7af73dd26c16501545086935
SHA256

331d55def39d58b50770bb647db0b98ae3d049a11626c7a76e0008ad84fba620
SHA512

0ecaa1375328cefe3f7b90d903005227cb67ad7a0a41959c5f55f1d5149caf9ad62efe59ea50b8310d342caa251e5e44fdca0196e9988213c949bf4d8e093bcc

Score

10^/10

dridex 10444 botnet discovery evasion trojan

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

174.128.245.202:443

51.83.3.52:13786

69.64.50.41:6602

rc4.plain

rc4.plain

Targets

- Target
  
  331d55def39d58b50770bb647db0b98ae3d049a11626c7a76e0008ad84fba620
- Size
  
  608KB
- MD5
  
  b8b4376c19a5cb6a2fe069441249bcf8
- SHA1
  
  5b7cbfb91c54484f7af73dd26c16501545086935
- SHA256
  
  331d55def39d58b50770bb647db0b98ae3d049a11626c7a76e0008ad84fba620
- SHA512
  
  0ecaa1375328cefe3f7b90d903005227cb67ad7a0a41959c5f55f1d5149caf9ad62efe59ea50b8310d342caa251e5e44fdca0196e9988213c949bf4d8e093bcc
Score

10^/10

dridex 10444 botnet discovery evasion trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

dridex10444botnetdiscoveryevasiontrojan