dridex | e924d66f382ff956b72bc7b201f56a2b880f329f26a559b673b3d001d9cc14cf | Triage

Sharing

General

Target

08f0663e022a3f2a5bb67e9de511497e
Size

1.1MB
Sample

231230-a3qsqseaa7
MD5

08f0663e022a3f2a5bb67e9de511497e
SHA1

f2420173bdd27d3d2651167111e6e38a4b7a1dfd
SHA256

e924d66f382ff956b72bc7b201f56a2b880f329f26a559b673b3d001d9cc14cf
SHA512

5d1b0d25ee5b89e67bb0515aa3f69e05eb38548d32df868632483358bf8379ebce201cd63037383cd254f3de6f173551f485ed43fca7ff5443cec0bc6cd989fd
SSDEEP

12288:nM+ZdkmHubeaCo6TRg522A/sUQBJ8uvp:nMcpTo6a00BOi

Score

10^/10

dridex 10111 botnet discovery evasion trojan

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

176.9.89.122:10172

147.91.31.1:6225

103.30.247.115:7443

rc4.plain

rc4.plain

Targets

- Target
  
  08f0663e022a3f2a5bb67e9de511497e
- Size
  
  1.1MB
- MD5
  
  08f0663e022a3f2a5bb67e9de511497e
- SHA1
  
  f2420173bdd27d3d2651167111e6e38a4b7a1dfd
- SHA256
  
  e924d66f382ff956b72bc7b201f56a2b880f329f26a559b673b3d001d9cc14cf
- SHA512
  
  5d1b0d25ee5b89e67bb0515aa3f69e05eb38548d32df868632483358bf8379ebce201cd63037383cd254f3de6f173551f485ed43fca7ff5443cec0bc6cd989fd
- SSDEEP
  
  12288:nM+ZdkmHubeaCo6TRg522A/sUQBJ8uvp:nMcpTo6a00BOi
Score

10^/10

dridex 10111 botnet discovery evasion trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

dridex10111botnetdiscoveryevasiontrojan

behavioral2

dridex10111botnetdiscoveryevasiontrojan