dridex | eeca50813e80c0c9611fe74e47917119450e6c07dcf0144305f20495369b3874 | Triage

Sharing

General

Target

eeca50813e80c0c9611fe74e47917119450e6c07dcf0144305f20495369b3874
Size

388KB
Sample

220503-zpzwxsfahq
MD5

5387d529d131fd51212a86b48a7bd9ad
SHA1

10016a0bfcf43951b575eb6ea8e9556728e4b503
SHA256

eeca50813e80c0c9611fe74e47917119450e6c07dcf0144305f20495369b3874
SHA512

70ca210071f84f321793000c9224244de5ffed5ae89afa1bfbfc9943f41b018ab1ad2ec57b49d657aa76a6c004b6277a677525b6a151b209b717da0113383368

Score

10^/10

dridex 10555 botnet cryptone discovery evasion packer trojan

Malware Config

Extracted

Family

dridex

Botnet

10555

C2

194.150.118.7:443

45.77.154.161:1688

45.56.127.75:49160

62.171.142.179:4664

rc4.plain

rc4.plain

Targets

- Target
  
  eeca50813e80c0c9611fe74e47917119450e6c07dcf0144305f20495369b3874
- Size
  
  388KB
- MD5
  
  5387d529d131fd51212a86b48a7bd9ad
- SHA1
  
  10016a0bfcf43951b575eb6ea8e9556728e4b503
- SHA256
  
  eeca50813e80c0c9611fe74e47917119450e6c07dcf0144305f20495369b3874
- SHA512
  
  70ca210071f84f321793000c9224244de5ffed5ae89afa1bfbfc9943f41b018ab1ad2ec57b49d657aa76a6c004b6277a677525b6a151b209b717da0113383368
Score

10^/10

dridex 10555 botnet discovery evasion trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

dridex10555botnetdiscoveryevasiontrojan

behavioral2

dridex10555botnet