Dridex is a prolific banking Trojan that first appeared in 2014. By December 2019, the US Treasury estimated Dridex had infected computers in hundreds of banks and financial institutions in over 40 countries, leading to more than $100 million in theft. Dridex was created from the source code of the Bugat banking Trojan (also known as Cridex).[1][2][3]

ID: S0384
Associated Software: Bugat v5
Platforms: Windows
Contributors: Daniyal Naeem, BT Security
Version: 2.0
Created: 30 May 2019
Last Modified: 01 October 2021

Associated Software Descriptions

Name Description
Bugat v5


Techniques Used

Domain ID Name Use
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

Dridex has used POST requests and HTTPS for C2 communications.[2][4]

Enterprise T1185 Browser Session Hijacking

Dridex can perform browser attacks via web injects to steal information such as credentials, certificates, and cookies.[1]

Enterprise T1573 .001 Encrypted Channel: Symmetric Cryptography

Dridex has encrypted traffic with RC4.[2]

.002 Encrypted Channel: Asymmetric Cryptography

Dridex has encrypted traffic with RSA.[2]

Enterprise T1106 Native API

Dridex has used the OutputDebugStringW function to avoid malware analysis as part of its anti-debugging technique.[4]

Enterprise T1027 Obfuscated Files or Information

Dridex's strings are obfuscated using RC4.[4]

Enterprise T1090 Proxy

Dridex contains a backconnect module for tunneling network traffic through a victim's computer. Infected computers become part of a P2P botnet that can relay C2 traffic to other infected peers.[1][4]

.003 Multi-hop Proxy

Dridex can use multiple layers of proxy servers to hide terminal nodes in its infrastructure.[4]

Enterprise T1219 Remote Access Software

Dridex contains a module for VNC.[1]

Enterprise T1518 Software Discovery

Dridex has collected a list of installed software on the system.[4]

Enterprise T1082 System Information Discovery

Dridex has collected the computer name and OS architecture information from the system.[4]

Enterprise T1204 .002 User Execution: Malicious File

Dridex has relied upon users clicking on a malicious attachment delivered through spearphishing.[4]

Groups That Use This Software

ID Name References
G0119 Indrik Spider


G0092 TA505