dridex | 30b6438b14eac5337f6d0f81997a4fce356611fc19155ae3650d5df21e894e74 | Triage

Submit
Reports

Overview

overview

Static

static

3

1cfba0904f...18.dll

windows7-x64

1cfba0904f...18.dll

windows10-2004-x64

Sharing

General

Target

1cfba0904f4423463f764a11a6fd4251_JaffaCakes118
Size

920KB
Sample

240701-3sshss1dml
MD5

1cfba0904f4423463f764a11a6fd4251
SHA1

a00c004b4de481c921c5ad2c98dcd87724b4b0a1
SHA256

30b6438b14eac5337f6d0f81997a4fce356611fc19155ae3650d5df21e894e74
SHA512

cc902fe1d2206b0f584fe3c0ba3874db4189a4f226da4c54a2a632deb719bb3d58cf934b467c58ad2d0ffcdd2672aef96b79e118c17a067d05ead2e4a3879a5f
SSDEEP

24576:bwWfnaVoffEQmyO378WTkvEKT9Hgce1BHboDCm:cuaq34yDWTkvvT9HgdboDC

Score

10^/10

dridex 10444 botnet discovery evasion trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

1cfba0904f4423463f764a11a6fd4251_JaffaCakes118.dll

Resource

win7-20240508-en

dridex 10444 botnet discovery evasion trojan

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral2

Sample

1cfba0904f4423463f764a11a6fd4251_JaffaCakes118.dll

Resource

win10v2004-20240611-en

dridex 10444 botnet discovery evasion trojan

windows10-2004-x64

5 signatures

150 seconds

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

209.20.87.138:443

198.1.115.153:8172

151.236.29.248:6516

rc4.plain

rc4.plain

Targets

- Target
  
  1cfba0904f4423463f764a11a6fd4251_JaffaCakes118
- Size
  
  920KB
- MD5
  
  1cfba0904f4423463f764a11a6fd4251
- SHA1
  
  a00c004b4de481c921c5ad2c98dcd87724b4b0a1
- SHA256
  
  30b6438b14eac5337f6d0f81997a4fce356611fc19155ae3650d5df21e894e74
- SHA512
  
  cc902fe1d2206b0f584fe3c0ba3874db4189a4f226da4c54a2a632deb719bb3d58cf934b467c58ad2d0ffcdd2672aef96b79e118c17a067d05ead2e4a3879a5f
- SSDEEP
  
  24576:bwWfnaVoffEQmyO378WTkvEKT9Hgce1BHboDCm:cuaq34yDWTkvvT9HgdboDC
Score

10^/10

dridex 10444 botnet discovery evasion trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

dridex10444botnetdiscoveryevasiontrojan

behavioral2

dridex10444botnetdiscoveryevasiontrojan

© 2018-2024

Terms | Privacy