dridex | 42ec022935f327b5fdcb0430349af3a5e369aeaa6e74a45525e841b7731c5490 | Triage

Sharing

General

Target

42ec022935f327b5fdcb0430349af3a5e369aeaa6e74a45525e841b7731c5490
Size

143KB
Sample

240417-qcj59sgf37
MD5

5c4dc17938a6c291585173747dc99034
SHA1

f2e1cca8eecfb880496942fc2d4e43f726b5046e
SHA256

42ec022935f327b5fdcb0430349af3a5e369aeaa6e74a45525e841b7731c5490
SHA512

ff41b9d8c6325c2877e5fba5eeb237b79b9419f865b50b786505e327b1ef2b134179c68b25ce5072067b153b7e68811d2ccd5582a42642545a059cd870a218f8
SSDEEP

3072:HPoyC64b0u/r2jtkpg0S5X8vNB1jhZxekL1G1tSNQsb3TGTP6a1tCj1:voyrKr2BkG0S5MljhjRG6NRb3TGTP6ac

Score

10^/10

dridex botnet evasion trojan

Malware Config

Extracted

Family

dridex

C2

195.123.213.19:443

195.123.238.51:443

45.129.96.9:443

Targets

- Target
  
  1d778359ab155cb190b9f2a7086c3bcb4082aa195ff8f754dae2d665fd20aa05.exe
- Size
  
  208KB
- MD5
  
  d0409052256c6efc85b155f58cc03f70
- SHA1
  
  3ab42ca8ce81f9df0c4f7cd807528c5dd0fb5108
- SHA256
  
  1d778359ab155cb190b9f2a7086c3bcb4082aa195ff8f754dae2d665fd20aa05
- SHA512
  
  3276daa266159b03820abf9e05aeec54e8ba6b748b5f44c76f5d8be0333a45490c7a93df3d227c74e5009b4ac2c08ae05d84862170766c7a304a30cc0bfbc6e5
- SSDEEP
  
  3072:ESf6yf4ZtuoMvwloVkldMkPH7fp6CmSIPSi6/8NK3c3:XCyw7cqo+llPHICmSAUJ3
Score

10^/10

dridex botnet evasion trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Deletes itself
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dridexbotnetevasiontrojan

behavioral2

dridexbotnetevasiontrojan