파일 Kimligi
| SHA256 | b804a5b07e90170c3640e0c0bfc6af38bccc8abbafbffe132a1808d6d0f24cae |
|---|---|
| 크기 | 802.816 byte |
| String Sayisi | 2.394 (sifrelenmis) |
Analiz
Dridex, tum konfigurasyonunu (C2 listesi, web inject kurallar, hedef bankalarin URL'leri) sifrelenmis XML blob'larinda saklar. Statik string analizinde cleartext IOC bulunamadi.
Dridex 아키텍처si
| Modul | Fonksiyon |
|---|---|
| Loader (core) | C2 haberlesme, modul indirme, anti-analiz |
| Web Inject | MITB (Man-in-the-Browser) bankacilik sayfasi manipulasyonu |
| Botnet | P2P C2 haberlesme (EB3 protokol) |
| Credential Harvester | Tarayici sifre, form veri calma |
| Spam Module | Banka hesap bilgisi icin kimlik avı email gondermek |
Dridex Hakkinda
Dridex (Evil Corp/TA505 iliskilendirilir), 2011'de Cridex'ten turetilen ve bankaci trojan'lar icinde en gelismis olanlarindan biridir. UK ve US bankacilik sistemlerini yoğun olarak hedef almistir. P2P botnet mimarisi sayesinde tek nokta C2 altyapi cokusuna direnclidir. Evil Corp uyeleri 2019'da ABD tarafindan yargilanmis, ancak Rusya'da serbestce faaliyet gosterdigi bilinmektedir.
IOC
| SHA256 | b804a5b07e90170c3640e0c0bfc6af38bccc8abbafbffe132a1808d6d0f24cae |
|---|---|
| C2 | P2P sifrelenmis (XOR/RC4) |
Dridex — 악성코드 프로필
Dridex Bugat TA505 banking trojan. Chrome/Firefox form hooking with obfuscated strings. DirectUI RTTI.
기술 세부 정보
Dridex (Bugat/Cridex) is a modular banking trojan operated by TA505/Evil Corp since 2011. Uses peer-to-peer botnet architecture for C2 communication to resist takedowns. Modules: form grabber, VNC backdoor, network proxy, credential stealer, spread module. Encrypted communication: RC4 + custom protocol over HTTP. Delivered via Microsoft Office macro phishing (VBA macros). Used to deliver: BitPaymer, WastedLocker, Grief (PayOrGrief) ransomware. Evil Corp sanctioned by US Treasury October 2019, making ransom payments illegal for US entities. Dridex infrastructure heavily overlaps with Locky ransomware campaigns. Botnet IDs (bot IDs): 220, 444, 7777, multiple active botnets simultaneously.
귀속 / 위협 행위자
Evil Corp (TA505), Maksim Yakubets (indicted by FBI)
기능 및 동작
IOC 목록 (1 개 지표)
# SHA256
b804a5b07e90170c3640e0c0bfc6af38bccc8abbafbffe132a1808d6d0f24cae
| 유형 | 값 | 메모 |
|---|---|---|
| sha256 | b804a5b07e90170c3640e0c0bfc6af38bccc8abbafbffe132a1808d6d0f24cae |
C2 서버 (이 패밀리에 대해 3개의 서버 기록)
| 주소 | 유형 | 포트 | 프로토콜 | 상태 | 국가 |
|---|---|---|---|---|---|
| 79.141.164.52 | ip | 4444 | TCP | sinkholed | RO |
| 185.234.218.151 | ip | 4444 | HTTPS | sinkholed | RU |
| 77.73.133.84 | ip | 443 | HTTPS | sinkholed | BG |
C2 주소는 KEYDAL 팀이 수동으로 검증한 악성코드 샘플에서만 제공됩니다. 상업적 사용은 금지됩니다.