dridex | 5dde1846f1d669b3ec1f043c7dffa3f4f02496f136add4319ff5fc806b0b9d04 | Triage

Sharing

General

Target

5dde1846f1d669b3ec1f043c7dffa3f4f02496f136add4319ff5fc806b0b9d04
Size

143KB
Sample

240417-qlpr4saf9t
MD5

4a9e72f9a8608972cc3ea1d086994162
SHA1

66940bc93d403fc5542fffadf8c011e559f2a990
SHA256

5dde1846f1d669b3ec1f043c7dffa3f4f02496f136add4319ff5fc806b0b9d04
SHA512

e277f58989e5ae4c3ddbc21f3454afa9e96eab64e485b7d04bc26751d7c8c53f7320b2b024546b3b28e6d8ac4b2d97d93a20f6f737dcdca8c5e3984c16d0e605
SSDEEP

3072:LknNWpuwo63RhQd5EJTWNvVus+MRLTSLGCj4QCQAupy4i3X:wybudsSts9qTq4QvAupyrn

Score

10^/10

dridex botnet evasion trojan

Malware Config

Extracted

Family

dridex

C2

195.123.213.19:443

195.123.238.51:443

45.129.96.9:443

Targets

- Target
  
  1d778359ab155cb190b9f2a7086c3bcb4082aa195ff8f754dae2d665fd20aa05.exe
- Size
  
  208KB
- MD5
  
  d0409052256c6efc85b155f58cc03f70
- SHA1
  
  3ab42ca8ce81f9df0c4f7cd807528c5dd0fb5108
- SHA256
  
  1d778359ab155cb190b9f2a7086c3bcb4082aa195ff8f754dae2d665fd20aa05
- SHA512
  
  3276daa266159b03820abf9e05aeec54e8ba6b748b5f44c76f5d8be0333a45490c7a93df3d227c74e5009b4ac2c08ae05d84862170766c7a304a30cc0bfbc6e5
- SSDEEP
  
  3072:ESf6yf4ZtuoMvwloVkldMkPH7fp6CmSIPSi6/8NK3c3:XCyw7cqo+llPHICmSAUJ3
Score

10^/10

dridex botnet evasion trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Deletes itself
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dridexbotnetevasiontrojan

behavioral2

dridexbotnetevasiontrojan