Dridex | 威胁等级: critical | 类型: Banking Trojan

加密标识符

SHA256b9dac63c888f98e13799568be23d934cc5e929b1e71282b3eb5c83d3cbf21e7a
MD55ca09f4e3e8adcf9755415f40a43e89b
文件类型dll
大小552.0 KB
首次发现2021-12-22
文件名SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.1119
标签dll, Dridex

恶意软件家族: Dridex

Dridex, Evil Corp ile ilişkilidir.

类型Banking Trojan
编程语言C++
目标平台Windows
C2 协议HTTPS
用途Evil Corp bankacılık trojan
首次发现年份2012
别名Bugat

威胁指标 (IOC)

  • SHA256: b9dac63c888f98e13799568be23d934cc5e929b1e71282b3eb5c83d3cbf21e7a
  • MD5: 5ca09f4e3e8adcf9755415f40a43e89b

系统清理指南

  1. 将系统从网络断开——拔掉网线，关闭 Wi-Fi
  2. 在任务管理器中结束可疑进程
  3. 使用 Malwarebytes 或 Kaspersky 进行全盘扫描
  4. HKCU\Software\Microsoft\Windows\CurrentVersion\Run kayıtlarını kontrol edin
  5. 在任务计划程序中检查新建的计划任务
  6. 使用未感染的设备更改所有账户密码
  7. Gerekirse Windows'u yeniden yükleyin ve verilerinizi temiz bir yedeğe geri alın

YARA 规则提示

rule Dridex_SHA256 {
    meta:
        description = "Dridex sample: b9dac63c888f98e1"
        threat_level = "critical"
        first_seen = "2021-12-22"
    condition:
        hash.sha256(0, filesize) == "b9dac63c888f98e13799568be23d934cc5e929b1e71282b3eb5c83d3cbf21e7a"
}

Dridex — 恶意软件档案

Dridex Bugat TA505 banking trojan. Chrome/Firefox form hooking with obfuscated strings. DirectUI RTTI.

恶意软件类型
Other
编程语言
C++
C2协议
HTTPS
目标系统
Windows
别名 (AKA)
Bugat

技术细节

Dridex (Bugat/Cridex) is a modular banking trojan operated by TA505/Evil Corp since 2011. Uses peer-to-peer botnet architecture for C2 communication to resist takedowns. Modules: form grabber, VNC backdoor, network proxy, credential stealer, spread module. Encrypted communication: RC4 + custom protocol over HTTP. Delivered via Microsoft Office macro phishing (VBA macros). Used to deliver: BitPaymer, WastedLocker, Grief (PayOrGrief) ransomware. Evil Corp sanctioned by US Treasury October 2019, making ransom payments illegal for US entities. Dridex infrastructure heavily overlaps with Locky ransomware campaigns. Botnet IDs (bot IDs): 220, 444, 7777, multiple active botnets simultaneously.

归因 / 威胁行为者

Evil Corp (TA505), Maksim Yakubets (indicted by FBI)

能力与行为

Zararlı Yazılım Aktivitesi
Kalıcılık Mekanizması
C2 İletişimi
Anti-Analiz

IOC列表 (2 个指标)

IOC — Dridex
# SHA256 b9dac63c888f98e13799568be23d934cc5e929b1e71282b3eb5c83d3cbf21e7a # MD5 5ca09f4e3e8adcf9755415f40a43e89b
类型值备注
sha256 b9dac63c888f98e13799568be23d934cc5e929b1e71282b3eb5c83d3cbf21e7a
md5 5ca09f4e3e8adcf9755415f40a43e89b
Dridex — 查看完整档案 →

C2服务器 (该家族共有 3 台已记录服务器)

地址 类型 端口 协议 状态 国家
79.141.164.52 ip 4444 TCP sinkholed RO
185.234.218.151 ip 4444 HTTPS sinkholed RU
77.73.133.84 ip 443 HTTPS sinkholed BG

C2 地址仅来自 KEYDAL 团队人工验证的恶意软件样本。禁止用于商业用途。

标签
dridexbanking trojanmalwarecriticalsha256analizzenginleştirilmiş