Hello.
Welcome to a new section.
In this section we are going to unpack the Dridex Trojan.
So go and download Dridex, unzip it and put it on a desktop in a folder called Dridex.
Inside the folder there will be a file with this long hash.
This is a Sha256 hash so you can check the hash by right clicking and then hash my files.
So click on hash my files and it will generate all the hashes for you.
And you can see Sha256, this is the one Sha256 hash.
So you can go and get more information about the Trojan by copying the hash Sha256 copy right clicking
and copying Sha256 and go to VirusTotal, click on search right click and paste the Sha256 click search
and it will come up with the result for this region.
You can see here quite a long hit.
And if you scroll down, you can see the name Dridex here, banker, banker, Trojan and various names
for this Trojan.
And here you can see.
Relax.
And then you can also go to online to read up more about the extrusion over here.
So relax is a form of malware that targets victims banking information.
And if you scroll down, you see how the strategies work.
It spreads through spam emails using a attachment.
Microsoft Word Excel, which contains a macro embedded with the file.
So when you open the file, you will download Dridex.
So this is how most of the modern Trojans work.
They are spread through email attachments, normally through a Microsoft Word Excel or Microsoft document
or even PDF documents.
So now we can analyze this.
Before we unpack, we can make a copy of this.
Copy and paste and then rename it so that it's easier to read.
Rename it as Dridex.
Now you can scan it with the I go to flare, go to utilities, open up, detect it.
Easy.
Die.
And then click on the three dots here in the eye and then go to your desktop containing the folder.
Inside it, click on projects, click on Drive X Open.
And you see inside here doesn't mention anything about any protector, probably because this is a customized
one.
And then click on the entropy.
You will see it's 94% packed, very high entropy.
So this is indication that is packed.
Another way you can do a pre analysis is by opening with B studio.
So go to fly again and then under utilities look for B studio and open it and then drag the region into
B studio.
And from here you can see some initial analysis.
Entropy has also mentioned 7.536, which is high, maximum is eight.
So anything above seven is considered high is a 32 bit executable.
The description says this is an protect key grip program database, but this is fake.
It is actually a dried extrusion.
Now we can open it and take a look at it as first initial response with this Trojan.
So click on new and if you go to the desktop and try to open it, let's see what happens.
Click okay.
It gives you all this warning corrupted fix up tables.
So this is an indication it is a PAC file and it says some relocations are not applied.
And then those are early warning signals that this is a pack.
And you can see here very few functions.
And no inputs.
So another indication is back and the start entry point is very short.
Okay.
So we can close this now.
In the next video, we are going to start unpacking this Trojan.
Thank you for watching.