dridex

General

Target

JaffaCakes118_7529ff3f19ea565aa217b72b80daf579
Size

620KB
Sample

250103-3lhd9azjas
MD5

7529ff3f19ea565aa217b72b80daf579
SHA1

79740bb080dae6eb1fbfe07bdbcae23c116aea98
SHA256

79a2e8ca12d85114df7e1f8c6490220ad0128e462aaa26cdd580a0ad6aa87f98
SHA512

56392a24c7d30631cc93fcbfe1f5f8810fa8596e633191a4a35e129b90818418d340e2467439cf572b3908af15e46769e249b26a06a81bbcac06f7d3373d6a23
SSDEEP

12288:zE6rSiF4Wbs3j09TMmonCh5atbz9+eoQoUZpDd7Da1nX9y1VO/zFZxL:RerD3j0dMZnCutz4zI5xDwXUfmB

Score

10^/10

Malware Config

Extracted

Family

dridex

Botnet

10222

C2

174.128.245.202:443

51.83.3.52:13786

69.64.50.41:6602

rc4.plain

Targets

- Target
  
  JaffaCakes118_7529ff3f19ea565aa217b72b80daf579
- Size
  
  620KB
- MD5
  
  7529ff3f19ea565aa217b72b80daf579
- SHA1
  
  79740bb080dae6eb1fbfe07bdbcae23c116aea98
- SHA256
  
  79a2e8ca12d85114df7e1f8c6490220ad0128e462aaa26cdd580a0ad6aa87f98
- SHA512
  
  56392a24c7d30631cc93fcbfe1f5f8810fa8596e633191a4a35e129b90818418d340e2467439cf572b3908af15e46769e249b26a06a81bbcac06f7d3373d6a23
- SSDEEP
  
  12288:zE6rSiF4Wbs3j09TMmonCh5atbz9+eoQoUZpDd7Da1nX9y1VO/zFZxL:RerD3j0dMZnCutz4zI5xDwXUfmB
Score

10^/10

dridex 10222 botnet discovery evasion trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex family
  dridex
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Dridex family

Blocklisted process makes network request

Checks installed software on the system

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2