Posted by Virus Bulletin on Jul 13, 2015
Meng Su explains how Dridex works and how it communicates with its C&C server.
A descendant of Cridex, Dridex was first written about a little less than a year ago, by S21sec and abuse.ch. Since then, Dridex has evolved to become one of the more prevalent banking trojans.
Dridex often spreads via attachments to spam messages, for instance as the payload to malicious Office macros, which a user is tricked into activating.
Today, we publish an analysis of Dridex by Tencent researcher Meng Su. In the paper she looks at how Dridex obtains the Windows APIs it uses and how it then sends information on the system to a command and control server.
You can read the paper here in HTML format or here as a PDF.
