dridex | 3f2957d66b293e7166a08abfb16c14c07f81ef6484e8db8f385e59a1d32bb196 | Triage

Sharing

General

Target

3f2957d66b293e7166a08abfb16c14c07f81ef6484e8db8f385e59a1d32bb196
Size

1.0MB
Sample

211028-jce3zsheg2
MD5

760a5ffe86379b3973a9c0e29008fbbc
SHA1

1cbece6f0c74199ed4f42fc35e4ce5d70d194106
SHA256

3f2957d66b293e7166a08abfb16c14c07f81ef6484e8db8f385e59a1d32bb196
SHA512

7c243bd07a675d738b1d83bd6ae405800da9c686f6e7cecdff8ec233670fcfe2c07cde4d554fad1e98747093b3345477eb0c14f0b9e7e44e3e6615763fa23b70

Score

10^/10

dridex 10444 botnet discovery evasion trojan

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

192.46.210.220:443

143.244.140.214:808

45.77.0.96:6891

185.56.219.47:8116

rc4.plain

rc4.plain

Targets

- Target
  
  3f2957d66b293e7166a08abfb16c14c07f81ef6484e8db8f385e59a1d32bb196
- Size
  
  1.0MB
- MD5
  
  760a5ffe86379b3973a9c0e29008fbbc
- SHA1
  
  1cbece6f0c74199ed4f42fc35e4ce5d70d194106
- SHA256
  
  3f2957d66b293e7166a08abfb16c14c07f81ef6484e8db8f385e59a1d32bb196
- SHA512
  
  7c243bd07a675d738b1d83bd6ae405800da9c686f6e7cecdff8ec233670fcfe2c07cde4d554fad1e98747093b3345477eb0c14f0b9e7e44e3e6615763fa23b70
Score

10^/10

dridex 10444 botnet discovery evasion trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dridex10444botnetdiscoveryevasiontrojan