dridex | c22ba6fa0d8d20bf022fac6e0083c82586d3e1331a999e443dc44976b228176f | Triage

Sharing

General

Target

ce7142adf3cbac3b7e7796399de482b9
Size

1.1MB
Sample

240316-tarzwaea9t
MD5

ce7142adf3cbac3b7e7796399de482b9
SHA1

28f44852a6e52411b016ab2557da1029f44712bc
SHA256

c22ba6fa0d8d20bf022fac6e0083c82586d3e1331a999e443dc44976b228176f
SHA512

caca539a4e073137861baf2922b34e6b68e5f2eacadc3dca7aeb679f2b70418ca322870a62a8931753aa40295477732e77c1ef7345b4154f2133a7060fcc1df6
SSDEEP

12288:PM+ZdkmHubeaCo6Lga1w2A/sUQBJ8Yvp:PMcpTo6sg+0BO8

Score

10^/10

dridex 10111 botnet discovery evasion trojan

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

177.52.173.20:9043

192.100.170.1:10172

166.62.103.55:7443

rc4.plain

rc4.plain

Targets

- Target
  
  ce7142adf3cbac3b7e7796399de482b9
- Size
  
  1.1MB
- MD5
  
  ce7142adf3cbac3b7e7796399de482b9
- SHA1
  
  28f44852a6e52411b016ab2557da1029f44712bc
- SHA256
  
  c22ba6fa0d8d20bf022fac6e0083c82586d3e1331a999e443dc44976b228176f
- SHA512
  
  caca539a4e073137861baf2922b34e6b68e5f2eacadc3dca7aeb679f2b70418ca322870a62a8931753aa40295477732e77c1ef7345b4154f2133a7060fcc1df6
- SSDEEP
  
  12288:PM+ZdkmHubeaCo6Lga1w2A/sUQBJ8Yvp:PMcpTo6sg+0BO8
Score

10^/10

dridex 10111 botnet discovery evasion trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

dridex10111botnetdiscoveryevasiontrojan

behavioral2

dridex10111botnetdiscoveryevasiontrojan