DridexMalware
- bugat v5
OxCERT blog describes Dridex as "an evasive, information-stealing malware variant; its goal is to acquire as many credentials as possible and return them via an encrypted tunnel to a Command-and-Control (C&C) server. These C&C servers are numerous and scattered all over the Internet, if the malware cannot reach one server it will try another.From MISP Galaxy
Last reported 3 years ago, by Elastic Security Labs3 reports
ATT&CK techniques
6 of 11 · each with the sentence it comes from- T1005Data from Local System
“Data from Local System”
- T1021.001Remote Desktop Protocol
“The attackers also used Remote Desktop Protocol (RDP) for lateral movement.”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Dynamic API Resolution”
- T1027.007Dynamic API Resolution
“Dynamic API resolution”
- T1033System Owner/User Discovery
“System Owner/User Discovery”
- T1041Exfiltration Over C2 Channel
“Exfiltration Over C2 Channel”
What the reports say
3 reports, newest first · the exact sentence from each-
Elastic Security Labs discovers the LOBSHOT malware“TA505 is a well-known cybercrime group associated with Dridex, Locky, and Necurs campaigns.”
-
What Is Human-Powered Threat Hunting?“Sometimes, it’s other well-known strains such as Trickbot or Dridex, other times it’s highly destructive ransomware like Ryuk.”
-
Lock Like a Pro“Similar scripts are used as a delivery mechanism for other trojans, such as Dridex and Ursnif.”
Indicators in its reports
named in the reports above- hxxps://www.amydecke[.]websitein 1 report
- www.amydecke[.]websitein 1 report
- e4ea88887753a936…e27991856bf6in 1 report
- 95.217.125[.]200in 1 report
- hxxps://malpedia.caad.fkie.fraunhofer[.]de/actor/ta505in 1 report
- hxxps://www.malware-traffic-analysis[.]net/2023/01/23/index.htmlin 1 report
Copy these 6 indicators · defanged
Thanks — we review every report.