dridex | 2c503baff16b55a21344a28e8a67091f3e4fd032e248829dea27acb84221a7ba | Triage

Sharing

General

Target

2c503baff16b55a21344a28e8a67091f3e4fd032e248829dea27acb84221a7ba
Size

143KB
Sample

240417-qxeraabe3w
MD5

84336b022808645081a048f830bec467
SHA1

4bcecbf966dd4c6f35a827c1f37a5f1cbdc209d7
SHA256

2c503baff16b55a21344a28e8a67091f3e4fd032e248829dea27acb84221a7ba
SHA512

984f635adcddfd6d6b61c776e1702960a47437ee7b30bad01bf6f072840ca689514c185256decd3afdf05c9266265ad171c1341dbaaade2a8c625964886ca1ed
SSDEEP

3072:a2svraAop2+T5NyYs+rAestrxD4yJtPpsCaSpB:Zs+p2+FNJ+rtdVp9HB

Score

10^/10

dridex botnet evasion trojan

Malware Config

Extracted

Family

dridex

C2

195.123.213.19:443

195.123.238.51:443

45.129.96.9:443

Targets

- Target
  
  1d778359ab155cb190b9f2a7086c3bcb4082aa195ff8f754dae2d665fd20aa05.exe
- Size
  
  208KB
- MD5
  
  d0409052256c6efc85b155f58cc03f70
- SHA1
  
  3ab42ca8ce81f9df0c4f7cd807528c5dd0fb5108
- SHA256
  
  1d778359ab155cb190b9f2a7086c3bcb4082aa195ff8f754dae2d665fd20aa05
- SHA512
  
  3276daa266159b03820abf9e05aeec54e8ba6b748b5f44c76f5d8be0333a45490c7a93df3d227c74e5009b4ac2c08ae05d84862170766c7a304a30cc0bfbc6e5
- SSDEEP
  
  3072:ESf6yf4ZtuoMvwloVkldMkPH7fp6CmSIPSi6/8NK3c3:XCyw7cqo+llPHICmSAUJ3
Score

10^/10

dridex botnet evasion trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Deletes itself
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dridexbotnetevasiontrojan

behavioral2

dridexbotnetevasiontrojan