Trusted Design

New Dridex infection vector identified

概要

Malware authors can sometimes be creative in order to manipulate their human targets on the one hand and to circumvent security products, too. The experts of G DATA’s SecurityLabs analyzed a specially crafted Microsoft Word document the attackers used to install a rather famous banking Trojan called Dridex. This malicious document connects to a perfectly legitimate website to download the final payload. We assume that these two elements were chosen to trick security products. This scam is used more and more often to attack businesses, especially SMBs, in various countries.

Created: 2026-02-23

Indicators

• URL - http://pastebin.com/download.php?i=VTd9HVkz -
• FileHash-SHA256 - e2d878a43607c04f151052e81a560a80525a343ea4e719c3a79e1cc8c45e47c5 -
• FileHash-SHA256 - 0305dda6ec81e8d8ff90152094d5e5e0f8914aeb6d984ee48d72f405a9b90f90 -
• FileHash-SHA256 - 2e6af1212a81136b46af40bf82ddd11811dc64490336f7ce1059aa9dd3c39262 -
• URL - http://91.227.18.18/stat/get.php -

類似Pulses

• Signed Dridex Campaign (score: 0.79)
• Drixed / Dridex - Sophisticated Banking Malware (score: 0.78)
• Banking Trojan DRIDEX (score: 0.76)
• Malicious Office files dropping Kasidet and Dridex (score: 0.76)
• Banking Malware Dridex Arrives via Phishing Email (score: 0.74)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る