dridex | a3066562a0f0628d82467df1b5de046c0c16db9bb7f916c8d0767b8b28ed3aa0 | Triage

Sharing

General

Target

0616d8e4828791df3068f9d35f1ddd42
Size

1.1MB
Sample

231224-t4qc5scagk
MD5

0616d8e4828791df3068f9d35f1ddd42
SHA1

ca37653fb12401a918f23727688f6ecf058d4b90
SHA256

a3066562a0f0628d82467df1b5de046c0c16db9bb7f916c8d0767b8b28ed3aa0
SHA512

58438b73c5f3d2a3057519540ecd26c3c754f3602dc59e8b82a6611fff188e0f318144cd13d4958d2bc603970aa9044f2850528c207aead30c5296119b8a3626
SSDEEP

6144:DK6cyPiWCgknQ/HuyIzuTVzsMM56519p+6yT1+ga1td0HZOUlcRxfc:DM+ZdkmHubeaCo6Lga1QHZbOx

Score

10^/10

dridex 10111 botnet discovery evasion trojan

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

177.52.173.20:9043

192.100.170.1:10172

166.62.103.55:7443

rc4.plain

rc4.plain

Targets

- Target
  
  0616d8e4828791df3068f9d35f1ddd42
- Size
  
  1.1MB
- MD5
  
  0616d8e4828791df3068f9d35f1ddd42
- SHA1
  
  ca37653fb12401a918f23727688f6ecf058d4b90
- SHA256
  
  a3066562a0f0628d82467df1b5de046c0c16db9bb7f916c8d0767b8b28ed3aa0
- SHA512
  
  58438b73c5f3d2a3057519540ecd26c3c754f3602dc59e8b82a6611fff188e0f318144cd13d4958d2bc603970aa9044f2850528c207aead30c5296119b8a3626
- SSDEEP
  
  6144:DK6cyPiWCgknQ/HuyIzuTVzsMM56519p+6yT1+ga1td0HZOUlcRxfc:DM+ZdkmHubeaCo6Lga1QHZbOx
Score

10^/10

dridex 10111 botnet discovery evasion trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

dridex10111botnetdiscoveryevasiontrojan

behavioral2

dridex10111botnetdiscoveryevasiontrojan