dridex | 1bfde1b52b05ddab592668ec53b9cb235d422dbe83807ab1cd8f7c579a34c997 | Triage

Sharing

General

Target

1bfde1b52b05ddab592668ec53b9cb235d422dbe83807ab1cd8f7c579a34c997
Size

130KB
Sample

240417-qk773ahb54
MD5

3662181f60db0b6a8f53d31cf22de470
SHA1

969c484ba226f5b9a6f223337fadb6f1e7960be0
SHA256

1bfde1b52b05ddab592668ec53b9cb235d422dbe83807ab1cd8f7c579a34c997
SHA512

741a97c990a9c2e66cd1586bce5863d213fbfcf4e899c421a0acade5ab4eb71bfafebd657c5d3aa5089d72a0ff8133285d4ad1987c95a493a738d40d4cdc5fb6
SSDEEP

1536:Ty2u60/SraJcfq01lpNgcLQvs17v+BR54H617q6iLW+HiWOxHpbiD7XmpT:qiNgcLQvs1gRz7qUBJcOT

Score

10^/10

dridex botnet evasion trojan

Malware Config

Extracted

Family

dridex

C2

5.44.45.177:443

185.16.41.224:443

91.235.129.113:443

Targets

- Target
  
  aadb5217c4c9316b90ce4eb5f2b52f72d34d426d66ce00c9addaef1654853acf.exe
- Size
  
  158KB
- MD5
  
  7239da273d3a3bfd8d169119670bb745
- SHA1
  
  f624d419671b8eef94241bd010a1ca0c22950fec
- SHA256
  
  aadb5217c4c9316b90ce4eb5f2b52f72d34d426d66ce00c9addaef1654853acf
- SHA512
  
  daa0d4e3e6dfe79c14cc7f0995c8601662546e24b8af5963fca1d79bf751f9a4fbc46516a1833335d47845345c21ef8c2fa1b1e9ee878382010fcbbb5e715431
- SSDEEP
  
  3072:ikQFgEaZRySp/EkD2ZHZ8ueA6+M4sdSRICtulvlpb/:2gFSSNEkaHZ8v+M4sdOU
Score

10^/10

dridex botnet evasion trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Deletes itself
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

dridexbotnetevasiontrojan

behavioral2

dridexbotnetevasiontrojan