Dridex: Chasing a Botnet from the Inside - Seguridad Mania.com - España y América Latina

In light of recent news about Dridex takedown, AnubisNetworks Labs team would like to take this webinar to share with the community some of the efforts undertaken during this investigation led by the NCA, with our participation, to track this malware and exploit its communication channels. In March 2015, AnubisNetworks Labs team started analyzing multiple malware samples of the Dridex family which ultimately led to running a fake node inside Dridex botnets. Dridex has been around since November 2014 and it is an evolution of the malware families known as Bugat, Geodo, Feodo and Cridex. The malware is distributed via email, with a malicious Microsoft Word document as attachment which, once opened, downloads a second stage payload that infects the system. Primarily targeting homebanking users, it is a malware with various capabilities including man in the browser, keylogger, proxy and VNC. It features a peer-to-peer (P2P) network and uses cryptography on its communication channels. Dridex botmasters are very active, launching new campaigns against different geographies, hardening the botnet infrastructure with new countermeasures and command and control systems on a regular basis. By hiding inside Dridex, our researchers compiled and gained knowledge about this botnet modus operandi. In this webinar AnubisNetworks´ security team will share the research done, focusing Key takeways from this webinar: · Map Dridex infections of associated botnets; · Understand the complexity of Dridex communication channels; · How we run a fake Dridex node