dridex | b6bd8479ef5943eaf26efdcda11ab09bf0569ad2295ba905fc0901511ca7c286 | Triage

Submit
Reports

Overview

overview

Static

static

3

2ad88b7755...18.dll

windows7-x64

2ad88b7755...18.dll

windows10-2004-x64

Sharing

General

Target

2ad88b77551488cce9e7b33a6f6af6bc_JaffaCakes118
Size

920KB
Sample

240708-d5klaazhrq
MD5

2ad88b77551488cce9e7b33a6f6af6bc
SHA1

3ffe54dd18132fb8fae311c5c6d7ce0250ff5cef
SHA256

b6bd8479ef5943eaf26efdcda11ab09bf0569ad2295ba905fc0901511ca7c286
SHA512

5500d544187da7d097f91297d9c86350aca2a36ec82ff6652b1fb95ae7e89e1862c27545c86ec41166237ee9abd66374c5bd4a39a5a0ef16340d004dda45d982
SSDEEP

24576:ftWfnaVoffEQmyO378WTkvEKT9Hgce1BHbonCm:luaq34yDWTkvvT9HgdbonC

Score

10^/10

dridex 10444 botnet discovery evasion trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

2ad88b77551488cce9e7b33a6f6af6bc_JaffaCakes118.dll

Resource

win7-20240221-en

dridex 10444 botnet discovery evasion trojan

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral2

Sample

2ad88b77551488cce9e7b33a6f6af6bc_JaffaCakes118.dll

Resource

win10v2004-20240704-en

dridex 10444 botnet discovery evasion trojan

windows10-2004-x64

5 signatures

150 seconds

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

209.20.87.138:443

198.1.115.153:8172

151.236.29.248:6516

rc4.plain

rc4.plain

Targets

- Target
  
  2ad88b77551488cce9e7b33a6f6af6bc_JaffaCakes118
- Size
  
  920KB
- MD5
  
  2ad88b77551488cce9e7b33a6f6af6bc
- SHA1
  
  3ffe54dd18132fb8fae311c5c6d7ce0250ff5cef
- SHA256
  
  b6bd8479ef5943eaf26efdcda11ab09bf0569ad2295ba905fc0901511ca7c286
- SHA512
  
  5500d544187da7d097f91297d9c86350aca2a36ec82ff6652b1fb95ae7e89e1862c27545c86ec41166237ee9abd66374c5bd4a39a5a0ef16340d004dda45d982
- SSDEEP
  
  24576:ftWfnaVoffEQmyO378WTkvEKT9Hgce1BHbonCm:luaq34yDWTkvvT9HgdbonC
Score

10^/10

dridex 10444 botnet discovery evasion trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

dridex10444botnetdiscoveryevasiontrojan

behavioral2

dridex10444botnetdiscoveryevasiontrojan

© 2018-2024

Terms | Privacy