dridex | 0f2404288ec2d5a8fd318b6169644b686d6a61e23f9952884b255e6d0845c064 | Triage

Sharing

General

Target

0f2404288ec2d5a8fd318b6169644b686d6a61e23f9952884b255e6d0845c064
Size

538KB
Sample

220319-nes5vagfc4
MD5

d76d0aae2bc54602ebfce443aa4f06a3
SHA1

425b105cbe970b3d38212ebf06b233f61de7fdb9
SHA256

0f2404288ec2d5a8fd318b6169644b686d6a61e23f9952884b255e6d0845c064
SHA512

262637fab6707b1d5d20aef6b51e172eb9b80a04ee5617a7aa556dd744f3f373b05af9b0d5729f9ed8e13eb019986cf75178741a70027c23bd62ced7a83fd4ef

Score

10^/10

dridex 10555 botnet discovery evasion trojan

Malware Config

Extracted

Family

dridex

Botnet

10555

C2

169.255.216.36:443

138.201.138.91:3389

89.174.36.41:4643

87.106.89.36:3389

rc4.plain

rc4.plain

Targets

- Target
  
  0f2404288ec2d5a8fd318b6169644b686d6a61e23f9952884b255e6d0845c064
- Size
  
  538KB
- MD5
  
  d76d0aae2bc54602ebfce443aa4f06a3
- SHA1
  
  425b105cbe970b3d38212ebf06b233f61de7fdb9
- SHA256
  
  0f2404288ec2d5a8fd318b6169644b686d6a61e23f9952884b255e6d0845c064
- SHA512
  
  262637fab6707b1d5d20aef6b51e172eb9b80a04ee5617a7aa556dd744f3f373b05af9b0d5729f9ed8e13eb019986cf75178741a70027c23bd62ced7a83fd4ef
Score

10^/10

dridex 10555 botnet discovery evasion trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

dridex10555botnetdiscoveryevasiontrojan

behavioral2

dridex10555botnet