dridex | a0536058320c509f5eb8d2508be328253c721a6f53e88e3bb5fcfecb768fc6af | Triage

Sharing

General

Target

a0536058320c509f5eb8d2508be328253c721a6f53e88e3bb5fcfecb768fc6af
Size

747KB
Sample

220317-wzx9asebcq
MD5

af31b669e8e8d7c42a12c4bac085e6a7
SHA1

f2c88e9e0839ad63d8d20cc4e0cd7d7711e927c4
SHA256

a0536058320c509f5eb8d2508be328253c721a6f53e88e3bb5fcfecb768fc6af
SHA512

8d884ee491fbd05592b5a161692a066b0688caa0f23d3789398fe7bf80e65be29e662ffac002103d4de684afb923ba12a7247f54e41828deed78f0d7f97d536d

Score

10^/10

dridex 10111 botnet discovery evasion trojan

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

51.254.163.104:1688

142.4.6.57:14043

195.159.28.230:4443

64.225.35.35:3098

rc4.plain

rc4.plain

Targets

- Target
  
  a0536058320c509f5eb8d2508be328253c721a6f53e88e3bb5fcfecb768fc6af
- Size
  
  747KB
- MD5
  
  af31b669e8e8d7c42a12c4bac085e6a7
- SHA1
  
  f2c88e9e0839ad63d8d20cc4e0cd7d7711e927c4
- SHA256
  
  a0536058320c509f5eb8d2508be328253c721a6f53e88e3bb5fcfecb768fc6af
- SHA512
  
  8d884ee491fbd05592b5a161692a066b0688caa0f23d3789398fe7bf80e65be29e662ffac002103d4de684afb923ba12a7247f54e41828deed78f0d7f97d536d
Score

10^/10

dridex 10111 botnet discovery evasion trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- DridexLoader
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

dridex10111botnetdiscoveryevasiontrojan

behavioral2

dridex10111botnetdiscoveryevasiontrojan