dridex | 42910a93637d89980d1863033db8f826017ecb582c3096807ee941d08eb9ded6 | Triage

Sharing

General

Target

42910a93637d89980d1863033db8f826017ecb582c3096807ee941d08eb9ded6
Size

119KB
Sample

240417-qlqdmshb76
MD5

b46d0f0d80fb54eb50468d774e950375
SHA1

c942b570bac79ca99e99ff5018ed435c0ed2bd3d
SHA256

42910a93637d89980d1863033db8f826017ecb582c3096807ee941d08eb9ded6
SHA512

1e75868340ac4da78abb01d2964f12326029e83549d15a46ddbee336a763d662749a768389087c07cc82942b22e3bc231abe1126e523e75caee7c852b5d1365f
SSDEEP

1536:XmbcR8S6dF3gQc6PBmbNW0UYcGAp4IjBCQhGeDQRJHXXXvoPaEOaBOe+ts8LRnHX:2b+sR62MncGSdCQhVsHPowO85k1LGF

Score

10^/10

dridex botnet evasion trojan

Malware Config

Extracted

Family

dridex

C2

188.165.45.228:443

213.252.245.31:443

94.140.125.17:443

Targets

- Target
  
  741087126c1c7edec3d0a3bc3f490723a4f410e9a278444c812e7f79013bb996.exe
- Size
  
  184KB
- MD5
  
  0ef5c94779cd7861b5e872cd5e922311
- SHA1
  
  5b4b7a6f33d3188ae5211a4432d2a5c84c1da10e
- SHA256
  
  741087126c1c7edec3d0a3bc3f490723a4f410e9a278444c812e7f79013bb996
- SHA512
  
  5fa2ecc5185a0a3751135b16e315b69f38ddbbf55eb3f3207311a0ed5cb3ee7127253340466e63a3a3b13a956c5019bc19376dba7d3b590f95146bf2dd170f3b
- SSDEEP
  
  3072:Z/+Z4dcDXE3y6EgZkqfSk79TKP8mlSruPeco7QC:Z/+Z4dcDhrgZ36kxKTlSqPbo7
Score

10^/10

dridex botnet evasion trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Deletes itself
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

dridexbotnetevasiontrojan

behavioral2

dridexbotnetevasiontrojan