System

Dangerous version of the Dridex banking malware

53 Comments

 

Do you think Banks likely to remain top cyber crime targets. Looks back on 2016 the attackers using different methods which contain malicious attachments being sent to multiple banks. The most famous incident is US$81M Bangladesh Bank Heist on May 2016. We all known as a script kiddie is hard to create such storm. IT Dept especially financial institution they spend their man power and affords on end user computing area. Even though mobile phone, mobile computing devices and workstation are under IT governance.

Dridex is a strain of banking malware that leverages macros in Microsoft Office to infect systems. Earlier this year Symantec alerts the world that new malware is going to harvest the banking credentials of victims. And claimed that Dridex is now one of the most dangerous pieces of financial malware in the world.

Why does Dridex so dangerous?

As we know, tradition of malware operation relies on dropper file. A dropper is a program (malware component) that has been designed to “install” some sort of malware (virus, backdoor, etc.) to a target system. The earlier generation of dropper file package EXE file extension. As times go by anti-virus vendor has solutions quarantine malicious file. Whatever you receive on workstation anti-virus will isolate the file in sandbox for sterilization. The efficient way to identify malware do a comparison on malicious file checksum value. That is win or lost all depends on information of records (hash value) from antivirus vendor database.

Since the design goal of Dridex targets banking industry. The malware designer fully understand banking environment operation structure. The marco excel programming have large coverage of usage in banking environment. For instance FX (foreign exchange), Finanical, Dealing room, Trade financial…etc. Even though Bloomberg financial services, they have available solution collect the financial news data by microsoft DDE (dynamic data exchange) feature. Since DDE part of Excel spreadsheet function. See how critical of MS office application in banking operations.

Malware (Dridex) design enjoy the benefits of Microsoft marco language. The marco language like a auto robot assemble the malware body. The 1st phase of attack similar to classic email phishing technique which MS word document embedded (see above picture diagram point 1 – 6). The assemble of malware body incomplete and therefore may not trigger malware detector alarm. Dridex contains self replication feature driven by MS dot net mechanism on 2nd phase of process (see above picture diagram point 7 – 9). A dynamic link library will be assembled in the final phase (phase 3) of the process (see above picture diagram point 9 -11).

Malware detector can properly deny the growth of Dridex

Since classic UTM firewall and antivirus program might have function limitation against this type of malware. There are plenty of anti-malware products in the market have capabilities to reduce such malware infection storm. Friendly speaking, all depends right solution and right direction. No absolute definition. Below Yara rule can provide an idea to you in this regard.

rule Dridex_trojan_XML {
   meta:
      description = "Dridex Malware in XML Document"
      author = "    "
      date = "2016/09/09"
      hash1 = "666b2121cfb7871cd1354b08d51a36e4"
   strings:
      // can be ascii or wide formatted - therefore no restriction
      $c_xml      = "<?xml version="
      $C_word     = "<?mso-application progid=\"Word.Document\"?>"
      $C_macro    = "w:macrosPresent=\"yes\""
      $C_binary   = "<w:binData w:name="
      $C_0_chars  = "<o:Characters>0</o:Characters>"
      $c_1_line   = "<o:Lines>1</o:Lines>"
   condition:
      all of ($c*)
}

Malicious files contained Dridex footprint (assembly)

Recorded file names:

  • Dridex Malware.bin
  • 7f6c27356f9809eb7f1e7372dc1556ed76c43c47.doc
  • 2209_0C8D8115C2D2.doc
  • 34A7_FBD7E2BFD4.doc

Malicious site – Analysis date: 2016-10-25

URL: http://50.63.174.16/ (valid till now)

Comment:

53 thoughts on “Dangerous version of the Dridex banking malware”

  3. Thank you for sharing superb informations. Your site is very cool. I am impressed by the details that you¡¦ve on this website. It reveals how nicely you perceive this subject. Bookmarked this website page, will come back for more articles. You, my pal, ROCK! I found just the information I already searched everywhere and simply could not come across. What an ideal web site.

  4. Great work! That is the type of information that are supposed to be shared across the net. Disgrace on the search engines for now not positioning this publish higher! Come on over and talk over with my web site . Thanks =)

  5. wonderful issues altogether, you simply won a brand new reader. What might you recommend about your submit that you made a few days ago? Any sure?

  6. I would like to express my appreciation to you just for bailing me out of this particular predicament. Just after checking through the internet and coming across things which were not helpful, I assumed my entire life was gone. Existing without the answers to the difficulties you have resolved as a result of this short article is a serious case, and the kind that could have badly affected my career if I hadn’t discovered your web blog. Your main competence and kindness in controlling all the things was precious. I don’t know what I would have done if I had not encountered such a step like this. I am able to now look forward to my future. Thank you very much for this impressive and sensible guide. I will not think twice to recommend your web blog to any individual who requires direction about this matter.

  7. I loved as much as you will receive carried out right here. The sketch is attractive, your authored subject matter stylish. nonetheless, you command get bought an nervousness over that you wish be delivering the following. unwell unquestionably come further formerly again as exactly the same nearly a lot often inside case you shield this increase.

  8. Very nice post. I just stumbled upon your blog and wanted to say that I have truly enjoyed browsing your blog posts. In any case I’ll be subscribing to your feed and I hope you write again very soon!

  9. hello!,I like your writing very so much! proportion we communicate more about your post on AOL? I require a specialist on this area to unravel my problem. Maybe that’s you! Looking ahead to see you.

  10. I am extremely impressed with your writing skills as well as with the layout on your weblog. Is this a paid theme or did you customize it yourself? Either way keep up the excellent quality writing, it’s rare to see a nice blog like this one these days..

  11. “Greetings! Very helpful advice within this post! It is the little changes which will make the greatest changes. Thanks for sharing!”

  14. Thank you for the good writeup. It in fact was a amusement account it. Look advanced to far added agreeable from you! However, how could we communicate?

  16. Great blog here! Also your website so much up very fast! What host are you the usage of? Can I get your associate link on your host? I wish my web site loaded up as quickly as yours lol

  17. I have learn a few excellent stuff here. Certainly worth bookmarking for revisiting. I surprise how much attempt you place to make this sort of great informative web site.

  18. magnificent issues altogether, you just gained a emblem new reader. What may you recommend about your publish that you made some days ago? Any certain?

  19. Having read this I thought it was really informative. I appreciate you spending some time and energy to put this short article together. I once again find myself personally spending a significant amount of time both reading and posting comments. But so what, it was still worth it!

  20. I’ve read some good stuff here. Certainly worth bookmarking for revisiting. I wonder how much effort you put to create such a excellent informative site.

  21. I believe you have made some really fascinating points. Not too many others would actually think about this the direction you just did. I am really impressed that there is so much about this subject that has been revealed and you made it so nicely, with so considerably class. Outstanding one, man! Very wonderful things right here.

  22. Generally I don’t read post on blogs, however I would like to say that this write-up very pressured me to take a look at and do so! Your writing taste has been surprised me. Thank you, quite great article.

  23. Immediately after I to begin with still left a remark I look toward consist of clicked upon the -Inform me Though fresh feed-back are more- checkbox and towards already upon each individual season a remark is excess I recieve 4 e-mails with the very same exact remark.

  24. The application appears cogent and intriguing. Optimistic Luck! I’ll be sitting down within…

  26. My brother recommended I might like this blog. He was totally right. This post actually made my day. You can not imagine simply how much time I had spent for this information! Thanks!

  27. One thing I would like to reply to is that weightloss program fast can be carried out by the perfect diet and exercise. A person’s size not just affects the look, but also the general quality of life. Self-esteem, major depression, health risks, and also physical capabilities are impacted in putting on weight. It is possible to just make everything right but still gain. Should this happen, a medical problem may be the perpetrator. While a lot of food and not enough work out are usually at fault, common medical ailments and widespread prescriptions can certainly greatly increase size. Many thanks for your post right here.

  28. I am grateful for your post. I’d prefer to say that the price of car insurance varies from one coverage to another, mainly because there are so many different facets which bring about the overall cost. As an example, the model and make of the automobile will have a huge bearing on the purchase price. A reliable ancient family car will have a more affordable premium over a flashy performance car.

  29. I simply could not depart your site before suggesting that I extremely loved the usual info an individual supply in your visitors? Is gonna be back incessantly in order to investigate cross-check new posts

  30. Great blog post. The things i would like to bring about is that pc memory ought to be purchased should your computer is unable to cope with that which you do along with it. One can deploy two RAM memory boards with 1GB each, as an example, but not one of 1GB and one with 2GB. One should always check the company’s documentation for the PC to be sure what type of storage it can take.

  32. Thanks for your posting on this weblog. From my experience, occasionally softening right up a photograph could provide the digital photographer with an amount of an artsy flare. Often however, this soft clouds isn’t precisely what you had in your mind and can sometimes spoil an otherwise good photo, especially if you anticipate enlarging it.

  33. you are truly a just right webmaster. The website loading speed is incredible. It sort of feels that you are doing any unique trick. In addition, The contents are masterpiece. you’ve done a wonderful activity on this topic!

  34. Great post and right to the point. I am not sure if this is really the best place to ask but do you people have any thoughts on where to hire some professional writers? Thanks 🙂

  35. Nice read, I just passed this onto a friend who was doing some research on that. And he just bought me lunch because I found it for him smile So let me rephrase that: Thanks for lunch!

  36. I can’t think this dollars-starved Metropolis is shelling out $26,000 upon this kind of crosswalks.

  37. There is noticeably a lot of money to understand about this. I suppose you have made specific nice points in functions also.

  40. We are a group of volunteers and opening a new system in our community. Your web site provided us with valuable information to work on. You’ve done an impressive job and our entire community will be grateful to you.

  41. Thank you a bunch for sharing this with all people you actually recognise what you are speaking about! Bookmarked. Kindly also talk over with my site =). We could have a hyperlink alternate agreement among us!

  42. I’m truly enjoying the design and layout of your website. It’s a very easy on the eyes which makes it much more enjoyable for me to come here and visit more often. Did you hire out a developer to create your theme? Fantastic work!

  44. You can certainly see your skills within the work you write. The arena hopes for more passionate writers like you who aren’t afraid to mention how they believe. Always follow your heart.

  45. Hi thereHello thereHowdy! This postarticleblog post couldn’tcould not be written any bettermuch better! Reading throughLooking atGoing throughLooking through this postarticle reminds me of my previous roommate! He alwaysconstantlycontinually kept talking aboutpreaching about this. I willI’llI am going toI most certainly will forwardsend this articlethis informationthis post to him. Pretty sureFairly certain he willhe’llhe’s going to have a goodhave a very goodhave a great read. Thank you forThanks forMany thanks forI appreciate you for sharing!

  46. Heya i am for the first time here. I came across this board and I find It truly helpful & it helped me out much. I am hoping to provide something again and help others such as you aided me.

  47. I’m so happy to read this. This is the kind of manual that needs to be given and not the random misinformation that is at the other blogs. Appreciate your sharing this greatest doc.

  48. This website is amazing. I will tell about it to my friends and anybody that could be interested in this subject. Great work guys!

  49. I merely wish to tell you that I am new to blogging and incredibly liked your information. Likely I am likely to remember your blog post . You certainly have superb article content. Acknowledge it for sharing with us your current website information

  50. I found so many interesting stuff in your blog especially its discussion. From the tons of comments on your articles, I guess I am not the only one having all the enjoyment here! keep up the good work..

  51. Needed to compose you a very little word to thank you yet again regarding the nice suggestions you’ve contributed here.

  52. (It has been simply incredibly generous with you to provide openly what exactly many individuals would’ve marketed for an ebook to end up making some cash for their end, primarily given that you could have tried it in the event you wanted.

Comments are closed.