dridex | 3eb3bafba40f4d9cb1ebb4d1312acd14f76969dbbb3d927d21e60dedee6ae346 | Triage

Sharing

General

Target

b02ff218fcefd37db4a972c7d075c8e0
Size

1.1MB
Sample

240301-dspz8sbg48
MD5

b02ff218fcefd37db4a972c7d075c8e0
SHA1

20f0579107283fd9a8f6e52b5a869325c45461e8
SHA256

3eb3bafba40f4d9cb1ebb4d1312acd14f76969dbbb3d927d21e60dedee6ae346
SHA512

5aad23d407a433d3ab8c9b6da1283d6cb9e1b60542c988fa380e90ad7dfb1352c4e8c989040e156f9d3980c146265671d91efd0a7b76c1231d175cd18e9d2848
SSDEEP

12288:fM+ZdkmHubeaCo6Lga1w2A/sUQBJ8Ivp:fMcpTo6sg+0BOM

Score

10^/10

dridex 10111 botnet discovery evasion trojan

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

177.52.173.20:9043

192.100.170.1:10172

166.62.103.55:7443

rc4.plain

rc4.plain

Targets

- Target
  
  b02ff218fcefd37db4a972c7d075c8e0
- Size
  
  1.1MB
- MD5
  
  b02ff218fcefd37db4a972c7d075c8e0
- SHA1
  
  20f0579107283fd9a8f6e52b5a869325c45461e8
- SHA256
  
  3eb3bafba40f4d9cb1ebb4d1312acd14f76969dbbb3d927d21e60dedee6ae346
- SHA512
  
  5aad23d407a433d3ab8c9b6da1283d6cb9e1b60542c988fa380e90ad7dfb1352c4e8c989040e156f9d3980c146265671d91efd0a7b76c1231d175cd18e9d2848
- SSDEEP
  
  12288:fM+ZdkmHubeaCo6Lga1w2A/sUQBJ8Ivp:fMcpTo6sg+0BOM
Score

10^/10

dridex 10111 botnet discovery evasion trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

dridex10111botnetdiscoveryevasiontrojan

behavioral2

dridex10111botnetdiscoveryevasiontrojan