TSPY_DRIDEX.NI
Win32/Dridex.P (ESET-NOD32); Worm.Win32.Cridex.qrt (Kaspersky); Trojan.Dridex.VX (Malwarebytes); Backdoor:Win32/Drixed (Microsoft); W32/Cridex.ANXK!tr (Fortinet); Drixed-FAJ!7E634A4D8EAA (McAfee)
Windows
Threat Type: Spyware
Destructiveness: No
Encrypted: Yes
In the wild: Yes
OVERVIEW
This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be downloaded from remote sites by other malware.
It connects to certain websites to send and receive information. However, as of this writing, the said sites are inaccessible. It deletes itself after execution.
TECHNICAL DETAILS
Arrival Details
This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It may be downloaded from remote site(s) by the following malware:
- W2KM_BARTALEX.NI
Information Theft
This spyware gathers the following data:
- Username
- Computer Name
- Installation Date
- Operating System version
- Installed Programs and version
Other Details
This spyware connects to the following website to send and receive information:
- https://{BLOCKED}.{BLOCKED}.139.58:843
- https://{BLOCKED}.{BLOCKED}.49.213:448
- https://{BLOCKED}.{BLOCKED}.10.253:8443
- https://{BLOCKED}.{BLOCKED}.199.100:8443
However, as of this writing, the said sites are inaccessible.
It deletes itself after execution.
NOTES:
If User Account Control is enabled on the affected system, it does the following routines:
- Drops a copy of itself as %AppDataLocal%\{random folder name}\{random filename}.exe
- Drops the file, %AppDataLocal%\{random 8 characters} which is also deleted afterwards
- For the malware to execute with administrative privileges, it injects its code to explorer.exe to load sysprep.exe and cryptbase.dll. It allows the malware to run without the UAC notification warnings.
SOLUTION
Step 1
Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.
Step 2
Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.
Step 3
Restart in Safe Mode
Step 4
Remove the malware/grayware file that dropped/downloaded TSPY_DRIDEX.NI. (Note: Please skip this step if the threat(s) listed below have already been removed.)
- W2KM_BARTALEX.NI
Step 5
Search and delete these files
- %AppDataLocal%\{random 8 characters}
Step 6
Restart in normal mode and scan your computer with your Trend Micro product for files detected as TSPY_DRIDEX.NI. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Did this description help? Tell us how we did.