The malware Dridex: origins and uses

**Executive summary:** This ANSSI report provides a comprehensive analysis of the Dridex banking trojan—its evolution, modular capabilities (loader, core, VNC, SOCKS, Pony, Kill OS, etc.), P2P botnet architecture, and the criminal group Evil Corp and affiliates that operate and distribute it—while detailing distribution methods (phishing, Emotet, exploit kits, FakeUpdates), associated ransomware (BitPaymer/DoppelPaymer), and a large set of IOCs and detection recommendations.