dridex

General

Target
3ff34263c3346b450522d2a24fefd3b2.dll
Size 248KB
Sample210205-88chab5fns
SHA256 04b524d3cefa896a6d477f9af5c565c63a0bee272b17c8930cf700f3a8e2c846
MD5 3ff34263c3346b450522d2a24fefd3b2
SHA1 b78d708519f458490aa79800f5552e474cb30cf5
SHA512 dfc0ce85ad6719c578e012662de0ec8bc4e33ecec7e438ba3d3ae4a454cdce14fdd456a5fc618a235b9743fe3c327bfb7908c16e8bd203d52a17193b093c56fa
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

dridex

Botnet

111

C2

77.220.64.133:443
62.14.242.133:8443
192.241.175.242:691
212.129.24.85:34443

rc4.plain

Targets

- Target
  3ff34263c3346b450522d2a24fefd3b2.dll
- Size 248KB
- SHA256 04b524d3cefa896a6d477f9af5c565c63a0bee272b17c8930cf700f3a8e2c846
- MD5 3ff34263c3346b450522d2a24fefd3b2
- SHA1 b78d708519f458490aa79800f5552e474cb30cf5
- SHA512 dfc0ce85ad6719c578e012662de0ec8bc4e33ecec7e438ba3d3ae4a454cdce14fdd456a5fc618a235b9743fe3c327bfb7908c16e8bd203d52a17193b093c56fa
- MD5 SHA1 SHA512
Score

10^/10

dridex 111 botnet discovery evasion loader trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Loader
  Detects Dridex both x86 and x64 loader in memory.
  botnet loader
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Dridex Loader

Blocklisted process makes network request

Checks installed software on the system

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2