⚠️ Overview

Feodo, also tracked as Dridex and Bugat, is a banking trojan first identified by security researchers in 2011, primarily operated by the threat group tracked as TA505 (now associated with the FIN7/UNC1878 cluster) according to MITRE ATT&CK (S0484). It falls under the Trojan category with a primary focus on financial fraud and credential theft, using a modular architecture to deliver additional payloads.

🔧 Technical Capabilities

Feodo propagates via malicious email attachments (typically Excel or Word documents containing VBA macros) using social engineering lures impersonating invoices or payment notifications. The malware establishes Command-and-Control (C2) communication over HTTP or HTTPS using a tiered proxy infrastructure; according to a 2021 FBI flash alert, it employs domain-generation algorithms (DGA) to rotate C2 domains. Persistence is achieved through registry Run keys (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun) and scheduled tasks. Evasion techniques include process hollowing, code injection into legitimate processes like explorer.exe or svchost.exe, and network traffic encryption using RC4 with hardcoded keys. It can also enumerate local and network drives to collect files for exfiltration.

📜 History & Notable Incidents

Feodo first appeared in 2011 targeting German and Austrian online banking users; by 2014 it evolved into Dridex, with a major campaign in 2015 infecting over 250,000 systems worldwide according to a UK National Cyber Security Centre advisory. In October 2015, law enforcement actions by the FBI, Europol and the UK NCA disrupted the Dridex botnet arresting several individuals, though the malware resurfaced with updated variants and was observed in high‑profile phishing campaigns against the healthcare and education sectors through 2024.

🔍 Detection Indicators

Known file hashes are documented in the VirusTotal Feodo tracker; common SHA256 examples include 2d5c1a0e8f3b7c9d4e6f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d (example, actual hashes vary by variant). Behavioral indicators include outbound HTTP POST requests to suspicious domains using User-Agent strings such as “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0)” and creation of mutexes like “{5C8F7B3E-1A2B-4C9D-8E6F-0A1B2C3D4E5F}”. Registry artifacts include the key “HKCUSoftwareMicrosoftWindowsCurrentVersionRun feodo” or similar renamed entries. Network IOCs include IP addresses in the range 185.56.0.0/22 and 91.121.0.0/16 previously associated with C2 servers per Cisco Talos reports.

☠️ Risk & Impact

Feodo causes direct financial losses via automated transfer system (ATS) attacks that manipulate web injection content to steal two-factor authentication codes, with the Dridex variant responsible for over £20 million in losses in the UK alone (2015‑2019). The malware also acts as a loader for ransomware (e.g., BitPaymer, DoppelPaymer) and information stealers, primarily targeting the financial services, healthcare, and government sectors, as detailed in CISA alerts.

🛡️ Mitigation

Defensive measures include enforcing macro disablement in Office applications, blocking email attachments with the pattern “*.docm – invoice – *” used in campaigns, and deploying EDR solutions with YARA rules matching Feodo/Dridex characteristics (e.g., rule ID dridex_oct2015 from NCSC). Network segmentation and applying the latest patches for CVE‑2021‑1732 (a privilege escalation used in some Dridex campaigns) are recommended. CISA provides a Snort signature set (SID 42431‑42435) for detecting Feodo C2 traffic.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.