dridex | 5b08fdb029e72ba743be44f2b53d808649446232ce4c9d81c5e788287acc57c9 | Triage

Sharing

General

Target

5b08fdb029e72ba743be44f2b53d808649446232ce4c9d81c5e788287acc57c9
Size

119KB
Sample

240417-qlrayaaf9x
MD5

3728cd3823de7b896fc5eca0b06bbcd2
SHA1

2e1c525bdb84b7ef98b8eb17f015fad71884c1ce
SHA256

5b08fdb029e72ba743be44f2b53d808649446232ce4c9d81c5e788287acc57c9
SHA512

13800d0699dc7703bc9e3b558e3a966a96dab739cf35ff8655005db5bce7ff89baf025f2c46a466a8407984d06cfaf6d44385cd3b0c03fbf8a301bb7f2031e14
SSDEEP

3072:YVmw2pPjibgu27T4QMtnc/OkpZdDadU/5cHIvn4:zr2Eu26niFGdUBeIv4

Score

10^/10

dridex botnet evasion trojan

Malware Config

Extracted

Family

dridex

C2

192.52.166.96:443

5.149.248.19:443

188.116.25.103:443

Targets

- Target
  
  6362084f61fa6a41b8b01b7c62215ad41a2623b69572ce558c33bffaa21f0af9.exe
- Size
  
  176KB
- MD5
  
  c8bb08283e55aed151417a9ad1bc7ad9
- SHA1
  
  57f8fe479206f195b630cf8232a0c0e9c5a47977
- SHA256
  
  6362084f61fa6a41b8b01b7c62215ad41a2623b69572ce558c33bffaa21f0af9
- SHA512
  
  91a76d1fffd3932864118b519b13554745518ebd3ef7ab7c5f7036e39456fd76883f7e91d817072847de5b5d89e98c052eed9422e58d469f04edf28f1780611e
- SSDEEP
  
  3072:FKbn6tE8guR4ltU9gxK7Lu6tdcjVBOY25Sn43p:FKb6tE8F4cgcLu6cdcSn
Score

10^/10

dridex botnet evasion trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Deletes itself
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

dridexbotnetevasiontrojan

behavioral2

dridexbotnetevasiontrojan