Dridex delivered by fake scan pdf attachment via link hidden behind fake recaptcha — 3 Comments

  1. Got all 3, all deliver identical bins
    File: 98ygubyr57.exe
    Size: 143360
    MD5: 925DA3A10F7DDE802C8D87047B14FDA6
    Compiled: Mon, Feb 5 2018, 10:35:30 – 32 Bit EXE

    Thanks for the writeup derek, I had not run into any recent dridex drops in a few weeks but I see its droppings, quite a bit at work.


  2. Got one with the subject: Electricity bill Feb-73958
    From: “Mamie Colvin”
    Pdf is: Feb-92680.pdf
    Capcha links to: hxxp://
    Dridex download hxxp://

    They are random senders and random PDF numbers

Leave a Reply

Your email address will not be published. Required fields are marked *