Dridex (Bugat) Technical Intelligence Dossier

Executive Summary & Threat Architecture

Dridex (also known as Bugat v5, Cridex, and Dridex Banking Trojan) is an infamous, highly sophisticated banking trojan and modular malware framework first documented in 2014 by security researchers, operated by the cybercriminal syndicate Evil Corp (tracked by authorities as the INDIGA group, led by Maksim Yakubets). Dridex evolved directly from the earlier Bugat and Cridex trojan lineages, fundamentally re-engineering credential theft and botnet survivability. The malware operates via an advanced modular loader architecture that employs multi-stage API hashing, environmental sandbox detection, and process hollowing (T1055.012) into legitimate Windows processes such as explorer.exe and svchost.exe. Dridex is renowned for its weaponized web-injection engine (Man-in-the-Browser, T1185), which hooks cryptographic and network APIs in Google Chrome, Microsoft Edge, Mozilla Firefox, and Internet Explorer. When a victim browses to targeted financial institutions, Dridex intercepts encrypted HTTPS sessions in real time, alters account balances on the fly, and injects rogue HTML/JavaScript fields to harvest two-factor authentication codes (SMS OTPs and chip-and-pin tokens). Beyond banking fraud, Dridex features an encrypted peer-to-peer (P2P) command-and-control network, XML-based configuration files encrypted with custom RC4/RSA schemes, and dynamic botnet routing nodes. From 2017 onward, Evil Corp leveraged Dridex as a high-value enterprise initial-access broker, utilizing its modular loader to deliver destructive corporate ransomware families, including BitPaymer, DoppelPaymer, and WastedLocker. In December 2019, the U.S. Department of Justice and the UK National Crime Agency indicted Evil Corp leadership, while OFAC levied sweeping financial sanctions, accompanied by CISA Alert AA19-339A detailing Dridex detection and remediation strategies.

Observed Threat Aliases: Dridex, Bugat v5, Cridex, bugat, W32.Cridex, Trojan:Win32/Dridex, Evil Corp Dridex

Ancestry & Lineage Tracking

Derived From / Upstream Ancestry: bugat, cridex

Documented Downstream Variants: dridex v1-v4, dridex v5, bitpaymer-precursor, doppelpaymer-precursor

Weaponized Vulnerabilities & Exploitation Topology

Documented common vulnerabilities and exposures (CVEs) weaponized by Dridex (Bugat) operators for initial execution, sandbox evasion, or SYSTEM-level kernel privilege escalation:

→ Explore all 77 exploited vulnerabilities on the SystemHelpDesk CVE Threat Matrix Hub.

MITRE ATT&CK® Tactical Tradecraft

Tactics, techniques, and procedures (TTPs) systematically mapped across real-world intrusion kill-chains:

→ Inspect the complete 226-technique matrix on the MITRE ATT&CK Defense Hub.

Indicators of Compromise (IOCs) & Forensic Artifacts

Curated indicators for retrospective threat hunting across SIEM and EDR platforms:

Initial Delivery Vectors

• Spear-phishing emails containing macro-enabled Microsoft Excel (.xlsm) or Word (.docm) documents disguised as invoices or payment receipts
• Compromised websites and initial access brokers (IABs) dropping Dridex loaders via Cobalt Strike or Cutwail botnet
• Exploitation of Microsoft Office memory corruption flaws CVE-2017-0199 and CVE-2017-11882

Host Persistence & Execution Hooks

• HKCU\Software\Microsoft\Windows\CurrentVersion\Run with randomized hexadecimal values
• Scheduled tasks named after legitimate Windows binaries (e.g., 'User_Feed_Synchronization')
• Process hollowing and thread hijacking into explorer.exe and svchost.exe

Reference File Hashes (SHA-256)

• 5c84dfc8df34e64ff476bf43a8ce90150e7b95204481ae515efb64dd9bf0e20e
• e5f492a5d2073fbcfd06ec4a29a1b15112028ddc87c14a22ad31737be70d8a57
• 3e62f02cb8594d6e902b115ee877990155b46e38a202722b51ee2bc3a4ea8474