Loading malware…
Dridex, also known as Bugat v5, is a modular Windows banking trojan derived from the earlier Bugat and Cridex families. It steals online-banking credentials by monitoring browser activity and using API hooking, malicious browser functionality, and keylogging. Its modules can capture screenshots, encrypt and exfiltrate collected information, download additional malware, and incorporate infected systems into a botnet. Peer-to-peer communications provide infrastructure redundancy, while multiple layers of proxy servers can conceal backend command-and-control infrastructure.
Dridex is commonly distributed through high-volume phishing and malicious-spam campaigns using invoice, payment, order, and other business-themed lures. Delivery chains use malicious Office documents, scripts, linked downloads, and compressed archives. Documents may persuade recipients to enable macros or exploit vulnerabilities such as CVE-2017-0199. Dridex operators have used DLL search-order hijacking involving legitimate Windows executables, and samples have attempted to bypass User Account Control using application compatibility databases. Packed and obfuscated variants complicate detection and analysis.
Dridex is closely associated with Evil Corp, also known as Indrik Spider, and has also been distributed in TA505 campaigns and through the Necurs spam botnet. Its targets include financial institutions and their customers, with infections also documented in government and other enterprise environments. Beyond banking fraud, Dridex has served as an initial-access and malware-delivery platform for ransomware operations, including attacks involving BitPaymer. It can deliver additional tools that allow attackers to expand an existing compromise; these downstream activities are distinct from its core banking-theft functionality.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
12 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Dridex is known to be developed and distributed by EvilCorp (aka Ta505).
“Prior to this threat, Storm-0324 had the following range of payload distribution: ... Dridex.”
Dridex is known to be developed and distributed by EvilCorp (aka Ta505).
A modified version of the banking trojan Dridex – named DoppelDridex – is being delivered via payloads staged on Slack and Discord CDNs.
Typically, this group varies its payloads which appear to be targeted by region – for example, in 2021, all TA544 Ursnif campaigns have specifically targeted Italian organizations while Dridex payloads associated with this threat actor do not have specific geographic targeting.
+6 more in the app. View in Mallory
18 distinct techniques documented for this family, organized by ATT&CK tactic.
several campaigns are leveraging attachments with the Excel 4.0 sheet-style macros to fetch the initial payload
leveraging attachments with the Excel 4.0 sheet-style macros to fetch the initial payload
The vulnerability allows Rich Text Format (RTF) documents to run scripts when opened.
To launch this malware, several campaigns are leveraging attachments with the Excel 4.0 sheet-style macros to fetch the initial payload
To disguise the source of malicious traffic, adversaries may chain together multiple proxies.
1,003 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.