dridex

General

Target

JaffaCakes118_e19a53f849c61ed1f4fd3650cd28f809
Size

608KB
Sample

250110-l78d5a1nfx
MD5

e19a53f849c61ed1f4fd3650cd28f809
SHA1

5923a4ac13789e5ee87f972b7d711d2e8cb1b8ea
SHA256

7771ced697b5b7e06699efe7e7d1423a89157c0a4e0713c24c68c0e6ec8b1eba
SHA512

41213fc1a1a01e1c85eb84bf592f920bbb831e373db687b8f32ca6b83f3f332f603c714b6d71e63824eebc2420b222febe01b68895cc774620dae61995a59d7d
SSDEEP

12288:9ZGQdqOGXyJqydLqQSeCqsVK8kPRGO35N9mVizXc6:9Z0aWjeCVVK8kP9N9om

Score

10^/10

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

174.128.245.202:443

51.83.3.52:13786

69.64.50.41:6602

rc4.plain

Targets

- Target
  
  JaffaCakes118_e19a53f849c61ed1f4fd3650cd28f809
- Size
  
  608KB
- MD5
  
  e19a53f849c61ed1f4fd3650cd28f809
- SHA1
  
  5923a4ac13789e5ee87f972b7d711d2e8cb1b8ea
- SHA256
  
  7771ced697b5b7e06699efe7e7d1423a89157c0a4e0713c24c68c0e6ec8b1eba
- SHA512
  
  41213fc1a1a01e1c85eb84bf592f920bbb831e373db687b8f32ca6b83f3f332f603c714b6d71e63824eebc2420b222febe01b68895cc774620dae61995a59d7d
- SSDEEP
  
  12288:9ZGQdqOGXyJqydLqQSeCqsVK8kPRGO35N9mVizXc6:9Z0aWjeCVVK8kP9N9om
Score

10^/10

dridex 10444 botnet discovery evasion trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex family
  dridex
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Dridex family

Blocklisted process makes network request

Checks installed software on the system

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2