Dridex

Category: banking_trojan · Aliases: Dridex, Bugat v5, Cridex, bugat, W32.Cridex, Trojan:Win32/Dridex, Evil Corp Dridex · Sample count (EMBER 2018): 59 · Enrichment: curated_sourced · Updated: 2026-10-16
Category: Banking_TrojanStatus: Automated SignaturePlatform: WINDOWS, WINDOWS_PEStage: Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Command And Control🕸 Explore Relationship Graph⚙ API JSON⚡ Sigma Rule💾 YARA RuleOS: Windows 11, Windows 10, Windows Server 2022
Executive Summary
Dridex (also known as Bugat v5, Cridex, and Dridex Banking Trojan) is an infamous, highly sophisticated banking trojan and modular malware framework first documented in 2014 by security researchers, operated by the cybercriminal syndicate Evil Corp (tracked by authorities as the INDIGA group, led by Maksim Yakubets).

Table of Contents

Overview

Dridex (also known as Bugat v5, Cridex, and Dridex Banking Trojan) is an infamous, highly sophisticated banking trojan and modular malware framework first documented in 2014 by security researchers, operated by the cybercriminal syndicate Evil Corp (tracked by authorities as the INDIGA group, led by Maksim Yakubets). Dridex evolved directly from the earlier Bugat and Cridex trojan lineages, fundamentally re-engineering credential theft and botnet survivability. The malware operates via an advanced modular loader architecture that employs multi-stage API hashing, environmental sandbox detection, and process hollowing (T1055.012) into legitimate Windows processes such as explorer.exe and svchost.exe. Dridex is renowned for its weaponized web-injection engine (Man-in-the-Browser, T1185), which hooks cryptographic and network APIs in Google Chrome, Microsoft Edge, Mozilla Firefox, and Internet Explorer. When a victim browses to targeted financial institutions, Dridex intercepts encrypted HTTPS sessions in real time, alters account balances on the fly, and injects rogue HTML/JavaScript fields to harvest two-factor authentication codes (SMS OTPs and chip-and-pin tokens). Beyond banking fraud, Dridex features an encrypted peer-to-peer (P2P) command-and-control network, XML-based configuration files encrypted with custom RC4/RSA schemes, and dynamic botnet routing nodes. From 2017 onward, Evil Corp leveraged Dridex as a high-value enterprise initial-access broker, utilizing its modular loader to deliver destructive corporate ransomware families, including BitPaymer, DoppelPaymer, and WastedLocker. In December 2019, the U.S. Department of Justice and the UK National Crime Agency indicted Evil Corp leadership, while OFAC levied sweeping financial sanctions, accompanied by CISA Alert AA19-339A detailing Dridex detection and remediation strategies.

Known aliases

Threat reports may refer to this family under multiple names:

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Derived From / Upstream Ancestry: Bugat · Cridex

Known Derivatives & Downstream Variants: Dridex V1-V4 · Dridex V5 · Bitpaymer-Precursor · Doppelpaymer-Precursor

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1185 · T1056.004 · T1055.012 · T1021.002 · T1071.001 · T1547.001 · T1001.003 · T1105

→ Explore the complete 226-Technique ATT&CK Threat Matrix

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

D3FEND IDCountermeasure NameTacticCountered ATT&CKDefensive Guidance
D3-NBANetwork Behavioral AnalysisDetectT1021.002Enforce SMB message signing, disable legacy SMBv1, and restrict administrative share access (C$, ADMIN$) to dedicated PAM bastion hosts.
D3-PHAProcess Hollowing AnalysisDetectT1055.012Inspect unbacked executable memory regions (PAGE_EXECUTE_READWRITE) for replaced PE image headers inside legitimate host processes.
D3-AHCAPI Hook DetectionDetectT1056.004Deploy kernel and userland EDR drivers to monitor SetWindowsHookEx and low-level keyboard hooks.
D3-WAFWeb Content Filtering & InspectionFilterT1071.001Block newly registered domains (NRDs) and inspect HTTP Host and URI headers for known C2 profiles.
D3-NTINetwork Traffic InspectionDetectT1105Inspect deep packet payloads for anomalous staging binaries and unauthorized egress protocols.
D3-MitBAMan-in-the-Browser AnalysisDetectT1185Deploy browser extension whitelisting and hardware-backed session binding to prevent rogue DOM and socket injection.
D3-RPMRegistry Persistence MonitoringDetectT1547.001Audit and restrict write privileges to user and machine-level Registry Run/RunOnce keys using Endpoint Privilege Management.

Exploited Vulnerabilities (CVEs)

This malware family is documented weaponizing the following common vulnerabilities and exposures:

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.

File hashes (SHA-256, sample)

Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.

Delivery vectors

Persistence mechanisms

SIEM / EDR Ingestion: Need these reference indicators for threat hunting?

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

Tier 1 Primitive Artifact Rule (Fast Triage)

Matches raw strings and file markers. Vulnerable to binary repacking and simple obfuscation.

rule MALWARE_WIN_DRIDEX_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dridex"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "dridex" ascii wide nocase
        $s2 = "dridex" ascii wide nocase
        $s3 = "bugat v5" ascii wide nocase
        $s4 = "cridex" ascii wide nocase
        $s5 = "bugat" ascii wide nocase
        $s6 = "w32.cridex" ascii wide nocase
        $s7 = "trojan:win32/dridex" ascii wide nocase
        $s8 = "evil corp dridex" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Tier 2 Behavioral Context Rule (Process Chains & Sigma)

Tracks parent-child process anomalies and suspicious scripting telemetry. Resilient against file renames.

title: SystemHelpDesk Detection - Dridex (Banking Trojan) Execution & Triage
id: 1d12992b-7ddc-5a57-8e7b-0736c9b89b2e
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Dridex malware family. Detects recon staging, certutil file payload staging,
  and web-inject process proxying characteristic of banking trojan initial loaders.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/dridex
- https://malware-families-catalog.systemhelpdesk.com/defensive/banking-trojan-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.banking-trojan
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1185
- attack.t1056_004
- attack.t1055_012
- attack.t1021_002
- attack.t1071_001
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \svchost.exe
    - \explorer.exe
    - \msiexec.exe
    - \certutil.exe
    CommandLine|contains:
    - -urlcache
    - -split -f
    - ipconfig /all
    - route print
    - netstat -ano
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: high

Tier 3 Attribution Fingerprint Rule (High Fidelity)

Deep signature matching distinctive operational fingerprints and payload characteristics.

rule MALWARE_WIN_DRIDEX_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dridex tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "dridex" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}
SOC & SIEM Rule Downloads: ⬇ Download YARA Rule (.yar) ⬇ Download Sigma Rule (YAML) ⬇ Download Sigma Rule (JSON) ⚙ Threat Profile API (JSON)

References & External Analysis

North American Authority Advisory (CISA / NIST)

The Cybersecurity and Infrastructure Security Agency (CISA) has published an official US federal advisory on this family, which can be mapped to NIST Cybersecurity Framework (CSF) incident response controls: AA19-339A ↗

Frequently Asked Questions

What is Dridex malware and who operates it?

Dridex is a modular banking trojan and initial-access loader that emerged in 2014 from the Bugat/Cridex codebase. It is developed and operated by the Russian cybercriminal syndicate Evil Corp (INDIGA), headed by Maksim Yakubets, which has caused hundreds of millions of dollars in financial theft worldwide.

How does Dridex intercept online banking credentials?

Dridex executes Man-in-the-Browser (MitB) attacks by hooking low-level Windows networking and browser socket APIs. When victims navigate to financial portals, Dridex injects rogue HTML and JavaScript into the web session, allowing it to capture credentials, intercept one-time passwords (OTPs), and alter transaction amounts before encryption.

How is Dridex distributed to enterprise workstations?

Dridex is predominantly distributed through high-volume spear-phishing and malspam campaigns containing macro-enabled Microsoft Word or Excel documents, weaponized PDFs, or exploit documents targeting vulnerabilities such as CVE-2017-0199 and CVE-2017-11882.

What is the operational relationship between Dridex and ransomware like BitPaymer?

Evil Corp pivoted Dridex from pure consumer banking theft to enterprise intrusion brokerage. Once Dridex established persistence on corporate workstations, operators conducted lateral movement across Active Directory using SMB and PowerShell to deploy high-impact ransomware payloads such as BitPaymer, DoppelPaymer, and WastedLocker.

What C2 architecture does Dridex utilize to evade disruption?

Dridex utilizes a tiered, encrypted peer-to-peer (P2P) botnet architecture. Compromised client nodes communicate with intermediate peer proxy nodes rather than central servers, shielding the master command-and-control servers from takedown operations and IP blacklisting.

How can defenders detect and hunt Dridex infections?

Security teams can hunt Dridex by monitoring abnormal process creation involving Office documents spawning PowerShell, cmd.exe, or rundll32.exe, detecting process hollowing into explorer.exe, and tracking anomalous HTTPS beaconing to rotating non-standard IP addresses identified in CISA Alert AA19-339A.

What remediation steps should be taken if Dridex is identified on a domain network?

Isolate the compromised host from the network immediately, preserve memory dumps for forensic analysis, reset all enterprise domain credentials, inspect Active Directory domain controller logs for unauthorized lateral movement, and audit backup systems to prevent ransomware execution.

How do I remove Dridex from Windows?

Manual removal of Dridex is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.

What are the main symptoms of a Dridex infection?

Symptoms of Dridex can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.

Protect Your Network Against Banking_Trojans

Want to prevent Dridex and similar threats from compromising your organization? Read our comprehensive defensive guide: Banking Trojan Protection for Businesses.

📣 Threat Intel Correction or Update?

Notice an outdated IOC, unlisted alias, or disputed attribution? Threat researchers are invited to propose an update on GitHub or contact the SystemHelpDesk research desk. All community revisions are credited in our public CHANGELOG.

Need help with an active incident? Published by the SystemHelpdesk threat intelligence team.

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/dridex.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.