dridex

General

Target
d288cf752413afeb829fe632399ab9850a361bb096cc604b611e6e9d7aef1bf7
Size 188KB
Sample210224-55cm9c4mfe
SHA256 d288cf752413afeb829fe632399ab9850a361bb096cc604b611e6e9d7aef1bf7
MD5 b14b89ad08a9d9df715454b73ba6373f
SHA1 3c35b36a844afde5fc9704b3fd3f7085b6db78b5
SHA512 2fa64e107db62c656393b372a7a3b0046a5423cd2733b83863ae4ff976e4bb5f420cabdc48caad41213719a4229cd139cea983ac9ed8ffc4cbb4d174a29b364e
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

dridex

Botnet

111

C2

209.151.236.42:443
91.121.94.86:8172
5.189.144.136:6516

rc4.plain

Targets

- Target
  d288cf752413afeb829fe632399ab9850a361bb096cc604b611e6e9d7aef1bf7
- Size 188KB
- SHA256 d288cf752413afeb829fe632399ab9850a361bb096cc604b611e6e9d7aef1bf7
- MD5 b14b89ad08a9d9df715454b73ba6373f
- SHA1 3c35b36a844afde5fc9704b3fd3f7085b6db78b5
- SHA512 2fa64e107db62c656393b372a7a3b0046a5423cd2733b83863ae4ff976e4bb5f420cabdc48caad41213719a4229cd139cea983ac9ed8ffc4cbb4d174a29b364e
- MD5 SHA1 SHA512
Score

10^/10

dridex 111 botnet discovery evasion loader trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Loader
  Detects Dridex both x86 and x64 loader in memory.
  botnet loader
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Dridex Loader

Blocklisted process makes network request

Checks installed software on the system

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2