Updated Dridex Banking Trojan Returns

The banking Trojan Dridex has re-emerged with a new variant after a period of relatively low activity.

Threat ID:: CC-1142
Category:: Spyware, Trojan
Threat Severity:: Low
Threat Vector:: Macro, Email spam
Published:: 3 February 2017 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

This content has been archived

This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk

Summary

The banking Trojan Dridex has re-emerged with a new variant after a period of relatively low activity.

Affected platforms

The following platforms are known to be affected:

Microsoft Windows

All Windows versions, especially Windows 7.

Threat details

The new version of Dridex is being distributed via a malicious spam campaign that includes a macro-enabled Microsoft Word document that is used to download the Dridex binary. The malware includes the ability to bypass User Account Control (UAC) to escalate privileges.

The email has a subject line “You can now see your latest invoice for your account” and contains a malicious link. If the link is opened then the system will be infected with a trojan downloader - either Madness, Votwup or QuantLoader. Dridex will then be installed as the final payload for the purpose of monitoring banking websites and harvesting login credentials.

The UAC bypass uses recdisc.exe, a Windows default recovery disc which is included in a white-list of applications that has its permissions automatically elevated in Windows 7.

After successful infection, Dridex communicates with peers on ports 4431-4433 and communicates with the first-layer Command and Control (C2) on port 8443.

Remediation steps

Type	Step
	• Monitor network and proxy logs for indicators of compromise. • Never open email attachments or links from untrusted sources. If an email looks suspicious the user should try to make contact with the sender by other means to verify their identity. • Make sure that cyber-awareness training is kept up-to-date. • Malware definitions must be kept up-to-date. • Ensure that macros are disabled by default.

Type

Step

• Monitor network and proxy logs for indicators of compromise.
• Never open email attachments or links from untrusted sources. If an email looks suspicious the user should try to make contact with the sender by other means to verify their identity.
• Make sure that cyber-awareness training is kept up-to-date.
• Malware definitions must be kept up-to-date.
• Ensure that macros are disabled by default.

Last edited: 17 February 2020 11:40 am