dridex | d1da7bdd2fa82509d9b8f1c0e090bf2211426cf5d88a482b392d3f98a86575c2 | Triage

Sharing

General

Target

dd05cf513811245694d043924ce0dc61
Size

1.1MB
Sample

240325-cz5htsgg2t
MD5

dd05cf513811245694d043924ce0dc61
SHA1

ca54986410cefbb25c9e1600f9d5b3f795f3c350
SHA256

d1da7bdd2fa82509d9b8f1c0e090bf2211426cf5d88a482b392d3f98a86575c2
SHA512

d2a5b5fcd4822963372dfae56ee6b9cd71ab88d8b201cc0b45b99e4e0d4a391f074e6e7ee987674ded2a070fd1a87a260bcdf6da1abb2d30b6883336df165bc0
SSDEEP

12288:7CM+ZdkmHubeaCo6Lga1w2A/sUQBJ8Evp:OMcpTo6sg+0BOQ

Score

10^/10

dridex 10111 botnet discovery evasion trojan

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

177.52.173.20:9043

192.100.170.1:10172

166.62.103.55:7443

rc4.plain

rc4.plain

Targets

- Target
  
  dd05cf513811245694d043924ce0dc61
- Size
  
  1.1MB
- MD5
  
  dd05cf513811245694d043924ce0dc61
- SHA1
  
  ca54986410cefbb25c9e1600f9d5b3f795f3c350
- SHA256
  
  d1da7bdd2fa82509d9b8f1c0e090bf2211426cf5d88a482b392d3f98a86575c2
- SHA512
  
  d2a5b5fcd4822963372dfae56ee6b9cd71ab88d8b201cc0b45b99e4e0d4a391f074e6e7ee987674ded2a070fd1a87a260bcdf6da1abb2d30b6883336df165bc0
- SSDEEP
  
  12288:7CM+ZdkmHubeaCo6Lga1w2A/sUQBJ8Evp:OMcpTo6sg+0BOQ
Score

10^/10

dridex 10111 botnet discovery evasion trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

dridex10111botnetdiscoveryevasiontrojan

behavioral2

dridex10111botnetdiscoveryevasiontrojan