A recent Ursnif malspam campaign is seen as spoofing replies to emails and that includes Dridex as its follow-up malware. The campaign follows the typical pattern of Ursnif infection in which victims are asked to open a zip attachment containing Word documents with malicious macros. The document is password-protected and the password for the zip attachment is usually ‘777.’ It’s designed to infect a vulnerable windows host. Both Ursnif and Dridex stay persistent through the Windows registry. Ursnif copies itself and deletes the original version and Dridex remains persistent through DLL files. Enabling macros on the Word document dropped a script file in the C:\Windows\Temp directory, and the script file retrieved the initial Windows executable (EXE) file for Ursnif.
Traffic generated by Ursnif infections follows relatively consistent patterns. During these type of Ursnif infections, we often find follow-up malware retrieved by the Ursnif-infected host. In this case, it was Dridex. Dridex, a banking trojan, also known as Bugat and Cridex is a form of malware that specializes in stealing bank credentials via a system that utilizes macros from Microsoft Word.Ursnif Trojan (aka Dreambot, Gozi, and ISFB) is an information stealing trojan.