dridex | f1310a95c76c3d95de1d7775e4f1a797d65fdc1d0859728b93d6c2fd77d5b94a | Triage

Sharing

General

Target

b72c6f16a269030a880cba980d5abcbb
Size

1.1MB
Sample

240306-mazamaaa23
MD5

b72c6f16a269030a880cba980d5abcbb
SHA1

52abfeecf440bee6423961a05ef4607186d09629
SHA256

f1310a95c76c3d95de1d7775e4f1a797d65fdc1d0859728b93d6c2fd77d5b94a
SHA512

0afe9e68056e0cb03adf22042d0a1c9c9386a55712a5682338941f1c7f2c6bf3418e7e8fb1dee50ce8524f7fab094c3b050331351218e0af3bffa969bc106f56
SSDEEP

12288:EM+ZdkmHubeaCo6Lga1w2A/sUQBJ80vp:EMcpTo6sg+0BOg

Score

10^/10

dridex 10111 botnet discovery evasion trojan

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

177.52.173.20:9043

192.100.170.1:10172

166.62.103.55:7443

rc4.plain

rc4.plain

Targets

- Target
  
  b72c6f16a269030a880cba980d5abcbb
- Size
  
  1.1MB
- MD5
  
  b72c6f16a269030a880cba980d5abcbb
- SHA1
  
  52abfeecf440bee6423961a05ef4607186d09629
- SHA256
  
  f1310a95c76c3d95de1d7775e4f1a797d65fdc1d0859728b93d6c2fd77d5b94a
- SHA512
  
  0afe9e68056e0cb03adf22042d0a1c9c9386a55712a5682338941f1c7f2c6bf3418e7e8fb1dee50ce8524f7fab094c3b050331351218e0af3bffa969bc106f56
- SSDEEP
  
  12288:EM+ZdkmHubeaCo6Lga1w2A/sUQBJ80vp:EMcpTo6sg+0BOg
Score

10^/10

dridex 10111 botnet discovery evasion trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

dridex10111botnetdiscoveryevasiontrojan

behavioral2

dridex10111botnetdiscoveryevasiontrojan