dridex

General

Target
cf8d60e49fdc8587af2cc7a7635f882b390aa3af9b6f0d6d3752b2d97c1d083e
Size 188KB
Sample210224-bb832fpm4s
SHA256 cf8d60e49fdc8587af2cc7a7635f882b390aa3af9b6f0d6d3752b2d97c1d083e
MD5 25404ae2ab022f45033965500512ae83
SHA1 75afd63c845920e83d662ce19070e2490af5075e
SHA512 99b378acd6f13efcf00b3d40727b37081c8f97e66f8a6b8b3b643bf4728a6a2e85ad27294653cc7826bba4a14ef6579021bf031086260abfb9cbba0e8276e365
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

dridex

Botnet

111

C2

209.151.236.42:443
91.121.94.86:8172
5.189.144.136:6516

rc4.plain

Targets

- Target
  cf8d60e49fdc8587af2cc7a7635f882b390aa3af9b6f0d6d3752b2d97c1d083e
- Size 188KB
- SHA256 cf8d60e49fdc8587af2cc7a7635f882b390aa3af9b6f0d6d3752b2d97c1d083e
- MD5 25404ae2ab022f45033965500512ae83
- SHA1 75afd63c845920e83d662ce19070e2490af5075e
- SHA512 99b378acd6f13efcf00b3d40727b37081c8f97e66f8a6b8b3b643bf4728a6a2e85ad27294653cc7826bba4a14ef6579021bf031086260abfb9cbba0e8276e365
- MD5 SHA1 SHA512
Score

10^/10

dridex 111 botnet discovery evasion loader trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Loader
  Detects Dridex both x86 and x64 loader in memory.
  botnet loader
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Dridex Loader

Blocklisted process makes network request

Checks installed software on the system

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2