dridex | 7a77b516c563c8bbe904af3b90cfb89148b879b807aa34d93be3b1a2eb93a016 | Triage

Sharing

General

Target

fn58ds.pdf
Size

725KB
Sample

220522-f4hreafgc8
MD5

aa7ad8fdea021577637b6e0520046686
SHA1

f847d66c48d910ec01127d5e188ceaf4919d418f
SHA256

7a77b516c563c8bbe904af3b90cfb89148b879b807aa34d93be3b1a2eb93a016
SHA512

cd0744f471cbf9fa880ed16dc6d56a55a683f8d85fd5988f6532280c054200a8d83304a4e43d9801325925b81d4532d1cd25a5ec8c476159dc1c53049b9d5e9f

Score

10^/10

dridex 10444 botnet discovery evasion loader trojan

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

146.164.126.197:443

69.16.193.166:9443

193.90.12.122:3098

157.245.103.132:14043

rc4.plain

rc4.plain

Targets

- Target
  
  fn58ds.pdf
- Size
  
  725KB
- MD5
  
  aa7ad8fdea021577637b6e0520046686
- SHA1
  
  f847d66c48d910ec01127d5e188ceaf4919d418f
- SHA256
  
  7a77b516c563c8bbe904af3b90cfb89148b879b807aa34d93be3b1a2eb93a016
- SHA512
  
  cd0744f471cbf9fa880ed16dc6d56a55a683f8d85fd5988f6532280c054200a8d83304a4e43d9801325925b81d4532d1cd25a5ec8c476159dc1c53049b9d5e9f
Score

10^/10

dridex 10444 botnet discovery evasion loader trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Loader 'dmod' strings
  Detects 'dmod' strings in Dridex loader.
  botnet loader
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

dridex10444botnetdiscoveryevasionloadertrojan

behavioral2

dridex10444botnetloader