Trojan.Dridex.BB

Trojan.Dridex.BB is a detection for a variant of Dridex, one of the most established and financially damaging banking trojans in circulation. Also known historically as Cridex and Bugat, Dridex has been active since 2011 and is built for a single purpose: to steal online-banking credentials and use them to move money out of victims' accounts.

Dridex has been active for many years and continues to be detected in the wild. Samples of this variant are typically unsigned.

What Is Dridex?

Dridex is a modular banking trojan operated for financial fraud. After infecting a machine it installs a keylogger to record everything the victim types and uses web injection to alter online-banking pages in the browser, capturing usernames, passwords, and one-time codes. The stolen data enables attackers to launch fraudulent transfers, often within minutes of the theft.

How Dridex Spreads

Dridex is distributed almost exclusively through phishing email campaigns. The messages impersonate invoices, receipts, or notices from trusted companies and carry Microsoft Word or Excel attachments containing malicious macros. When the victim opens the file and enables macros, the document downloads and installs Dridex. It has also spread through exploit kits and exposed Remote Desktop (RDP) services.

What Trojan.Dridex.BB Does

• Keylogging: records keystrokes to capture banking logins and other credentials.
• Web injection: modifies banking sites in the browser to steal data and hide fraudulent activity.
• Evasion: behavioral analysis of this sample shows anti-debugging and process-manipulation techniques used to dodge security tools.
• Resilient C2: Dridex has historically used peer-to-peer command-and-control, making its infrastructure hard to disrupt.

Symptoms of Infection

• Fraudulent bank transfers or unauthorized account access.
• Sluggish performance and unexpected outbound network traffic.
• Office documents from unknown senders prompting you to "enable content."

Why Dridex Is Dangerous

Dridex causes direct, immediate financial loss and has been linked to large-scale banking fraud worldwide. Its long lifespan and constant retooling mean detections like Trojan.Dridex.BB remain a live threat. The Threat Scorecard and Analysis Report on this page reflect how SpyHunter's systems rate and observe this variant's behavior.

How to Remove Dridex

Because this threat runs as a file-based Windows infection, removal has two goals: stop the malicious process and delete every component it dropped, then confirm nothing was left behind to reinstall it.

Manual Steps

1. Disconnect the computer from the internet to cut the malware off from its command-and-control server.
2. Restart Windows in Safe Mode with Networking so the threat is not loaded at startup.
3. Open Task Manager and end any unfamiliar or suspicious background processes.
4. Check Settings → Apps and uninstall any program you do not recognize or did not intentionally install.
5. Review startup entries (Task Manager → Startup) and the Run registry keys for entries that point to random file names in temporary folders.
6. From a clean device, change your online-banking and email passwords immediately and contact your bank to watch for fraudulent transfers.
7. Clear temporary files to remove staging copies of the payload.

Recommended: Run a Full Malware Scan

Manual removal is difficult because modern threats hide components and can restore themselves. The most reliable way to fully remove Dridex and any additional malware it may have downloaded is to scan the system with a professional, up-to-date anti-malware tool such as SpyHunter. A complete scan will detect and remove the threat's files, registry entries, and related infections, helping restore the device to a clean, secure state.

Conclusion

Trojan.Dridex.BB is a serious, money-motivated infection. Remove it without delay, assume any credentials entered on the affected computer are compromised, and run a full security scan to confirm the trojan and any related components are gone.