dridex | 894b6115260fd89dc0661c57c17af7777797d1ae357ac6975fa94fb0088616d9 | Triage

Sharing

General

Target

894b6115260fd89dc0661c57c17af7777797d1ae357ac6975fa94fb0088616d9
Size

119KB
Sample

240417-qw7qnshh47
MD5

a29a980d57bdd670e0c85d96581e58e2
SHA1

6a1ef4201ab5141da9af6785c33587b0636261db
SHA256

894b6115260fd89dc0661c57c17af7777797d1ae357ac6975fa94fb0088616d9
SHA512

86419d75623c417d776e4c4ea920483e19d27fa57cc8735e2d25ebea9227762660907ddf502a9206e82692d8d5dc7051631bd6a8ec7c97be11754cb6c1ec17e5
SSDEEP

1536:mWowGZ5N9/NPFSXwPQeQQDzfaX/VpF0nMlQ3wHWza4IVDuNn0IqSQt4p1YOL+HKh:poZR/uXwYFizfG705oYIXr++Fs

Score

10^/10

dridex botnet evasion trojan

Malware Config

Extracted

Family

dridex

C2

188.165.45.228:443

213.252.245.31:443

94.140.125.17:443

Targets

- Target
  
  741087126c1c7edec3d0a3bc3f490723a4f410e9a278444c812e7f79013bb996.exe
- Size
  
  184KB
- MD5
  
  0ef5c94779cd7861b5e872cd5e922311
- SHA1
  
  5b4b7a6f33d3188ae5211a4432d2a5c84c1da10e
- SHA256
  
  741087126c1c7edec3d0a3bc3f490723a4f410e9a278444c812e7f79013bb996
- SHA512
  
  5fa2ecc5185a0a3751135b16e315b69f38ddbbf55eb3f3207311a0ed5cb3ee7127253340466e63a3a3b13a956c5019bc19376dba7d3b590f95146bf2dd170f3b
- SSDEEP
  
  3072:Z/+Z4dcDXE3y6EgZkqfSk79TKP8mlSruPeco7QC:Z/+Z4dcDhrgZ36kxKTlSqPbo7
Score

10^/10

dridex botnet evasion trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Deletes itself
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

dridexbotnetevasiontrojan

behavioral2

dridexbotnetevasiontrojan