Dridex | 威胁等级: critical | 类型: Banking Trojan

加密标识符

SHA256100368128e8d8232c205f123a95e3eb28994c9c295e886b2cefa700411c36f85
MD581aa099d3a5bcd684042f818fdd4500b
文件类型exe
大小888.0 KB
首次发现2022-03-23
文件名100368128e8d8232c205f123a95e3eb28994c9c295e886b2cefa700411c36f85
标签Dridex, exe

恶意软件家族: Dridex

Dridex, Evil Corp ile ilişkilidir.

类型Banking Trojan
编程语言C++
目标平台Windows
C2 协议HTTPS
用途Evil Corp bankacılık trojan
首次发现年份2012
别名Bugat

威胁指标 (IOC)

  • SHA256: 100368128e8d8232c205f123a95e3eb28994c9c295e886b2cefa700411c36f85
  • MD5: 81aa099d3a5bcd684042f818fdd4500b

系统清理指南

  1. 将系统从网络断开——拔掉网线，关闭 Wi-Fi
  2. 在任务管理器中结束可疑进程
  3. 使用 Malwarebytes 或 Kaspersky 进行全盘扫描
  4. HKCU\Software\Microsoft\Windows\CurrentVersion\Run kayıtlarını kontrol edin
  5. 在任务计划程序中检查新建的计划任务
  6. 使用未感染的设备更改所有账户密码
  7. Gerekirse Windows'u yeniden yükleyin ve verilerinizi temiz bir yedeğe geri alın

YARA 规则提示

rule Dridex_SHA256 {
    meta:
        description = "Dridex sample: 100368128e8d8232"
        threat_level = "critical"
        first_seen = "2022-03-23"
    condition:
        hash.sha256(0, filesize) == "100368128e8d8232c205f123a95e3eb28994c9c295e886b2cefa700411c36f85"
}

Dridex — 恶意软件档案

Dridex Bugat TA505 banking trojan. Chrome/Firefox form hooking with obfuscated strings. DirectUI RTTI.

恶意软件类型
Other
编程语言
C++
C2协议
HTTPS
目标系统
Windows
别名 (AKA)
Bugat

技术细节

Dridex (Bugat/Cridex) is a modular banking trojan operated by TA505/Evil Corp since 2011. Uses peer-to-peer botnet architecture for C2 communication to resist takedowns. Modules: form grabber, VNC backdoor, network proxy, credential stealer, spread module. Encrypted communication: RC4 + custom protocol over HTTP. Delivered via Microsoft Office macro phishing (VBA macros). Used to deliver: BitPaymer, WastedLocker, Grief (PayOrGrief) ransomware. Evil Corp sanctioned by US Treasury October 2019, making ransom payments illegal for US entities. Dridex infrastructure heavily overlaps with Locky ransomware campaigns. Botnet IDs (bot IDs): 220, 444, 7777, multiple active botnets simultaneously.

归因 / 威胁行为者

Evil Corp (TA505), Maksim Yakubets (indicted by FBI)

能力与行为

Zararlı Yazılım Aktivitesi
Kalıcılık Mekanizması
C2 İletişimi
Anti-Analiz

IOC列表 (2 个指标)

IOC — Dridex
# SHA256 100368128e8d8232c205f123a95e3eb28994c9c295e886b2cefa700411c36f85 # MD5 81aa099d3a5bcd684042f818fdd4500b
类型值备注
sha256 100368128e8d8232c205f123a95e3eb28994c9c295e886b2cefa700411c36f85
md5 81aa099d3a5bcd684042f818fdd4500b
Dridex — 查看完整档案 →

C2服务器 (该家族共有 3 台已记录服务器)

地址 类型 端口 协议 状态 国家
79.141.164.52 ip 4444 TCP sinkholed RO
185.234.218.151 ip 4444 HTTPS sinkholed RU
77.73.133.84 ip 443 HTTPS sinkholed BG

C2 地址仅来自 KEYDAL 团队人工验证的恶意软件样本。禁止用于商业用途。

标签
dridexbanking trojanmalwarecriticalsha256analizzenginleştirilmiş