ファイル Kimligi
| SHA256 | b804a5b07e90170c3640e0c0bfc6af38bccc8abbafbffe132a1808d6d0f24cae |
|---|---|
| サイズ | 802.816 byte |
| String Sayisi | 2.394 (sifrelenmis) |
Analiz
Dridex, tum konfigurasyonunu (C2 listesi, web inject kurallar, hedef bankalarin URL'leri) sifrelenmis XML blob'larinda saklar. Statik string analizinde cleartext IOC bulunamadi.
Dridex アーキテクチャsi
| Modul | Fonksiyon |
|---|---|
| Loader (core) | C2 haberlesme, modul indirme, anti-analiz |
| Web Inject | MITB (Man-in-the-Browser) bankacilik sayfasi manipulasyonu |
| Botnet | P2P C2 haberlesme (EB3 protokol) |
| Credential Harvester | Tarayici sifre, form veri calma |
| Spam Module | Banka hesap bilgisi icin kimlik avı email gondermek |
Dridex Hakkinda
Dridex (Evil Corp/TA505 iliskilendirilir), 2011'de Cridex'ten turetilen ve bankaci trojan'lar icinde en gelismis olanlarindan biridir. UK ve US bankacilik sistemlerini yoğun olarak hedef almistir. P2P botnet mimarisi sayesinde tek nokta C2 altyapi cokusuna direnclidir. Evil Corp uyeleri 2019'da ABD tarafindan yargilanmis, ancak Rusya'da serbestce faaliyet gosterdigi bilinmektedir.
IOC
| SHA256 | b804a5b07e90170c3640e0c0bfc6af38bccc8abbafbffe132a1808d6d0f24cae |
|---|---|
| C2 | P2P sifrelenmis (XOR/RC4) |
Dridex — マルウェアプロファイル
Dridex Bugat TA505 banking trojan. Chrome/Firefox form hooking with obfuscated strings. DirectUI RTTI.
技術詳細
Dridex (Bugat/Cridex) is a modular banking trojan operated by TA505/Evil Corp since 2011. Uses peer-to-peer botnet architecture for C2 communication to resist takedowns. Modules: form grabber, VNC backdoor, network proxy, credential stealer, spread module. Encrypted communication: RC4 + custom protocol over HTTP. Delivered via Microsoft Office macro phishing (VBA macros). Used to deliver: BitPaymer, WastedLocker, Grief (PayOrGrief) ransomware. Evil Corp sanctioned by US Treasury October 2019, making ransom payments illegal for US entities. Dridex infrastructure heavily overlaps with Locky ransomware campaigns. Botnet IDs (bot IDs): 220, 444, 7777, multiple active botnets simultaneously.
アトリビューション / 脅威アクター
Evil Corp (TA505), Maksim Yakubets (indicted by FBI)
機能と挙動
IOCリスト (1 件の指標)
# SHA256
b804a5b07e90170c3640e0c0bfc6af38bccc8abbafbffe132a1808d6d0f24cae
| タイプ | 値 | メモ |
|---|---|---|
| sha256 | b804a5b07e90170c3640e0c0bfc6af38bccc8abbafbffe132a1808d6d0f24cae |
C2サーバー (このファミリーで3台のサーバーを記録)
| アドレス | タイプ | ポート | プロトコル | ステータス | 国 |
|---|---|---|---|---|---|
| 79.141.164.52 | ip | 4444 | TCP | sinkholed | RO |
| 185.234.218.151 | ip | 4444 | HTTPS | sinkholed | RU |
| 77.73.133.84 | ip | 443 | HTTPS | sinkholed | BG |
C2アドレスはKEYDALチームが手動で検証したマルウェア検体のみに基づいて提供されています。商用利用は禁止です。