dridex | 5c31a1991b83b16d620785baf2e328b49cc684886f0682cfefc934c0f8762e93 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

5c31a1991b...93.dll

windows7-x64

5c31a1991b...93.dll

windows10-2004-x64

Sharing

General

Target

5c31a1991b83b16d620785baf2e328b49cc684886f0682cfefc934c0f8762e93
Size

788KB
Sample

250116-bgmdvstla1
MD5

57ff8aad6421b8785d191a75825a457d
SHA1

7991ebfc143d958342135a84297ee949ef110f2a
SHA256

5c31a1991b83b16d620785baf2e328b49cc684886f0682cfefc934c0f8762e93
SHA512

ec22ac2a7f68eb08b253a75efa75ca5d7dda6c726bc24f799556dd88f1347066c9a36ee683c8e77fef0cc42b0a86c4cbd6caabcf432134b63e815601b76fb908
SSDEEP

24576:9WyoyFMVMKkN3ZvxEhb0IsaQ4KriCo0j6Ij:oSuVMK6vx2RsIKNrj

Score

10^/10

dridex botnet discovery evasion payload persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

5c31a1991b83b16d620785baf2e328b49cc684886f0682cfefc934c0f8762e93.dll

Resource

win7-20240903-en

dridex botnet evasion payload persistence trojan

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

5c31a1991b83b16d620785baf2e328b49cc684886f0682cfefc934c0f8762e93.dll

Resource

win10v2004-20241007-en

dridex botnet discovery evasion payload persistence trojan

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  5c31a1991b83b16d620785baf2e328b49cc684886f0682cfefc934c0f8762e93
- Size
  
  788KB
- MD5
  
  57ff8aad6421b8785d191a75825a457d
- SHA1
  
  7991ebfc143d958342135a84297ee949ef110f2a
- SHA256
  
  5c31a1991b83b16d620785baf2e328b49cc684886f0682cfefc934c0f8762e93
- SHA512
  
  ec22ac2a7f68eb08b253a75efa75ca5d7dda6c726bc24f799556dd88f1347066c9a36ee683c8e77fef0cc42b0a86c4cbd6caabcf432134b63e815601b76fb908
- SSDEEP
  
  24576:9WyoyFMVMKkN3ZvxEhb0IsaQ4KriCo0j6Ij:oSuVMK6vx2RsIKNrj
Score

10^/10

dridex botnet evasion payload persistence trojan discovery
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex family
  dridex
- Dridex Shellcode
  Detects Dridex Payload shellcode injected in Explorer process.
  botnet payload
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dridexbotnetevasionpayloadpersistencetrojan

behavioral2

dridexbotnetdiscoveryevasionpayloadpersistencetrojan

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.