Rewterz Threat Alert – Malspam Campaigns Spreading Dridex Banking Trojan

November 20, 2019

Severity

High

Analysis Summary

Dridex also known as Bugat and Cridex is a form of malware that specializes in stealing bank credentials via a system that utilizes macros from Microsoft Word. Recent malspam campaigns have been observed delivering the Dridex banking malware on windows systems. The phishing emails contain a word or excel attachment with embedded macros. Once the target downloads the file and enables macros, Dridex is downloaded on the victim machine which may lead to financial theft.
The primary objective of this software is to steal banking information from users of infected machines to immediately launch fraudulent transactions. Bank information for the software installs a keyboard listener and performs injection attacks.

Impact

Theft of banking information
Fraudulent transactions
Financial loss

Indicators of Compromise

From Email

jclugo[@]nanodepot[.]mx
comprobantes[@]aviso[.]com[.]gt
trafficmxp[@]archive[.]airindia[.]it
rh[.]esod[@]atlanticahotels[.]com[.]br
atendimento[@]turboautocenter[.]com[.]br
info[@]centrotimarzignano[.]it
jcarrere[@]bld[.]com[.]ar
syful[@]comillaonline[.]com
ricardo[@]4rtransportes[.]com[.]br
gerentecompras[@]mayoreoferrefama[.]com
citas[@]portadacartagena[.]com
k-inagaki[@]link-vision[.]com
faturamentopm[@]coopmetro[.]com[.]br
dvalera[@]abastosbicentenario[.]gob[.]ve
ventas3[@]distribuidoradeaceros[.]mx
m[.]biec[@]gotec-group[.]com
informacion[@]actgrupo[.]com
contabilidad[@]insalus[.]es

MD5

ba87bd0a355d24ddc39c8cb2c7186abf
05ffb09ff7900cb970c245f94506dd7f
28bdba10872356b1887dcf0b70990ffc
a2eb8748c37efcb2ecba817b754d7871
923384cd1063c03f8e0bb44965187be7
9d68dec7048ab46ee26f2cf8ddfec07f
1daef4e6d1e3263d364ca28b599fdd21
f506a9e9b77f160026f46947c18a2b8a

SHA-256

6ddf5c04bca8882d1fdb7e4885c86b07876c907bd1fef61cf5545eedfc6b03e7
21de494751a16dca9bce6ace38e1d7be7a7846fb1d9a4a3c4e82b0f9db6e1e0a
690052ad639bf1c44de6fc385247b19f3b4254585208082bb7231cf28c3ff95e
d166416b665534fca9dec4b205a0c1f28fdd5dd2cb45b92be8a908c4d35f652a
87011e99a114ccff3994c196876d90e0f8627b2e040884cfbbb44033bbc22ac7
017d4751de322d3cfebbe452f28ea4b16f3412307c6567d9cb7790eac7dc4175
5203f290148afad7aec1493d56c43d0df5710e6a7c23ea2c1326f73ed7861d90
6b1b3cd62ba169a9be6e71d013a52575111b3a15d0cb3bace971031b82057411

Source IP

65[.]99[.]252[.]241
93[.]38[.]63[.]46
103[.]229[.]85[.]12
62[.]112[.]65[.]20
124[.]108[.]39[.]115
190[.]202[.]150[.]26
198[.]1[.]68[.]89
200[.]69[.]233[.]197
162[.]241[.]182[.]168
174[.]142[.]9[.]228
72[.]47[.]249[.]132
91[.]142[.]215[.]72

Remediation

Block the threat indicators at their respective controls.
Do not download files attached in emails coming from untrusted sources.
Do not enable macros for untrusted files.