A new variant of the Dridex banking Trojanhas gained the ability to successfully evade detection by traditional antivirus.
Dridex is a popular banking Trojan, first detected in 2014 and specializing in stealing online banking credentials. Since then, its creators have proven to be very active and are constantly evolving the capabilities of their malware.
In January of last year, researchers from Forcepoint found that Dridex had expanded its infection chain, targeting users not only through phishing campaigns but also through malicious FTP sites.
The latest Trojan variant was first discovered by researcher Brad Duncan. According to Duncan, the new Trojan strain uses a Whitelisting technique to block Windows Script Host components.
The malware uses XLS scripts to bypass detection attempts.
Dridex has also upgraded its library infrastructure. Dridex DLLs are 64-bit DLLs, with SHA256 hashes, that use filenames loaded by legitimate Windows executables. However, the filenames and hashes are refreshed and changed every time a victim logs on to an infected Windows.
According to security firm eSentire, Dridex's core functionality has received an additional upgrade. The company provides additional details about the new strain.
The ability of malware to evade detection raises many concerns, especially considering that the majority of users use traditional methods and antivirus products to protect their systems.
The positive thing, however, is that antivirus programs have also started to be upgraded, including the new strain of Dridex.
Of course, security experts should constantly remain vigilant, as it is more than certain that the creators of such malicious programs will continue to release new, more sophisticated strains.
