Dridex

Overview

Dridex is a prolific banking trojan that, per MITRE ATT&CK, first appeared in 2014. By December 2019 the US Treasury estimated Dridex had infected computers across hundreds of banks and financial institutions in over 40 countries, leading to more than $100 million in theft. Dridex was created from the source code of the Bugat banking trojan (also known as Cridex). It is distributed mainly through malicious email attachments, and its operators have also been linked to delivering ransomware.

Known aliases

Threat reports may refer to this family under multiple names:

• Dridex
• Bugat v5
• Cridex

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1185 T1056.004 T1055.012 T1021.002 T1071.001 T1547.001

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.004: Monitor for unauthorized keylogging, screen capturing, or web browser API hooking. Deploy EDR to detect API hooking.
• T1071.001: Implement web filtering and SSL/TLS inspection to detect malicious command and control (C2) traffic hiding in HTTP/HTTPS.
• T1185: Enforce strong MFA and use browser isolation or hardened browsers for sensitive financial or administrative portals to defeat session hijacking.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_DRIDEX {
    meta:
        description = "Detects Dridex (banking_trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "dridex" ascii wide nocase
        $s2 = "dridex" ascii wide nocase
        $s3 = "bugat v5" ascii wide nocase
        $s4 = "cridex" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Dridex Activity
id: b38ef686caf0103866339452d3d1c4fb
status: experimental
description: Detects generic indicators of the dridex malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*dridex*"
            - "*dridex*"
            - "*bugat v5*"
            - "*cridex*"
    condition: selection
level: medium

References & External Analysis

• MITRE ATT&CK: Dridex (S0384)
• CISA Advisory
• Search "dridex" on VirusTotal (External Analysis)

North American Authority Advisory (CISA / NIST)

The Cybersecurity and Infrastructure Security Agency (CISA) has published an official US federal advisory on this family, which can be mapped to NIST Cybersecurity Framework (CSF) incident response controls: https://www.cisa.gov/news-events/alerts/2019/12/13/dridex-malware

Frequently Asked Questions

Related Families (Category: banking_trojan)

Explore other malware families in the same category:

• Vawtrak
• Shiz
• Goznym
• Zusy
• Tinba

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/dridex.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.