Global Network had become a pain to work with and RM3_boss decided to rent Dridex for a few months until RM3 became ready.
Dridex
Dridex is a banking trojan/financial malware family associated with the Russian cybercriminal group Evil Corp.
Profile source: Mallory opens in a new tabDridex
Family profile
Dridex is a banking trojan/financial malware family associated with the Russian cybercriminal group Evil Corp. The provided content states that U.S. authorities said Dridex caused more than $100 million in financial losses worldwide, and that Evil Corp was sanctioned in 2019 for developing and distributing the malware. Dridex has been delivered through spearphishing and spam emails with malicious attachments or links, relying on user execution. The content also states that Dridex uses encoded PowerShell commands to download and execute malicious payloads, and that it has used HTTPS and HTTP POST requests for command-and-control communications. Multiple references describe Dridex as part of the broader initial-access and malware-delivery ecosystem: it has been used by TA505 in large-scale campaigns, has been rented or used by other criminal operators, and has served as first-stage malware whose access may later be sold to ransomware operators. The content further places Dridex among banking trojans that shifted over time from pure banking fraud toward loader and ransomware-enablement roles. Dridex is repeatedly linked in the content to Evil Corp’s wider criminal operations, including ransomware and money laundering. The alias provided in the content is bugat_v5.
Reported operators
Threat actors
6 named in public reportingThese criminal threat actors compromise victim organizations with first-stage malware like The Trick, Dridex, or Buer Loader and will then sell their access to ransomware operators to deploy data theft and encryption operations.
the messages and the delivery suggest they were sent by threat actor TA505, known for sending large-scale Dridex, Locky, and GlobeImposter campaigns, among others, over the last four years.
These criminal threat actors compromise victim organizations with first-stage malware like The Trick, Dridex, or Buer Loader and will then sell their access to ransomware operators to deploy data theft and encryption operations.
Storm-0324 has distributed a range of first-stage payloads since at least 2016, including: ... Dridex, a banking trojan
"TA573 is an affiliate distributor of Dridex, a malware strain that resurged in 2020... The malware itself is a creation of a Russian cyber crime group that calls itself Evil Corp..."
Exploited software
Vulnerabilities linked to Dridex
2 CVEsMITRE ATT&CK
Dridex in ATT&CK
51 distinct techniquesTechniques
51 techniques T1082 System Information Discovery T1027 Obfuscated Files or Information T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer T1566.002 Spearphishing Link T1059.001 PowerShell T1059 Command and Scripting Interpreter T1071.001 Web Protocols T1204.002 Malicious File T1566 Phishing T1203 Exploitation for Client Execution T1573 Encrypted Channel T1053.005 Scheduled Task T1090.003 Multi-hop Proxy T1486 Data Encrypted for Impact T1071 Application Layer Protocol T1204 User Execution T1059.005 Visual Basic T1185 Browser Session Hijacking T1048 Exfiltration Over Alternative Protocol T1113 Screen Capture T1056.001 Keylogging T1095 Non-Application Layer Protocol T1583 Acquire Infrastructure T1204.001 Malicious Link T1485 Data Destruction T1548 Abuse Elevation Control Mechanism T1562.004 Disable or Modify System Firewall T1568.001 Fast Flux DNS T1189 Drive-by Compromise T1056.003 Web Portal Capture T1041 Exfiltration Over C2 Channel T1219 Remote Access Tools T1583.001 Domains T1572 Protocol Tunneling T1555 Credentials from Password Stores T1090.001 Internal Proxy T1518 Software Discovery T1090.004 Domain Fronting T1573.001 Symmetric Cryptography T1053 Scheduled Task/Job T1622 Debugger Evasion T1218.010 Regsvr32 T1573.002 Asymmetric Cryptography T1555.003 Credentials from Web Browsers T1539 Steal Web Session Cookie T1106 Native API T1090 Proxy T1574.001 DLL T1568.002 Domain Generation Algorithms T1059.007 JavaScript
