SYMBOLCOMMON_NAMEaka. SYNONYMS
win.friedex (Back to overview)

FriedEx

aka: BitPaymer, DoppelPaymer, IEncrypt

Actor(s): INDRIK SPIDER

VTCollection    

There is no description at this point.

References
2023-03-06 ⋅ ⋅ Landeskriminalamt NRW ⋅ Landeskriminalamt NRW
Schlag gegen international agierendes Netzwerk von Cyber-Kriminellen
DoppelPaymer Entropy FriedEx
2022-06-13 ⋅ Jorge Testa ⋅ Jorge Testa
Killing The Bear - Evil Corp
FAKEUPDATES Babuk Blister DoppelPaymer Dridex Entropy FriedEx Hades Macaw Phoenix Locker WastedLoader WastedLocker
2022-06-02 ⋅ Mandiant ⋅ Mandiant Intelligence
To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions
FAKEUPDATES Blister Cobalt Strike DoppelPaymer Dridex FriedEx Hades LockBit Macaw MimiKatz Phoenix Locker WastedLocker
2022-02-01 ⋅ Sentinel LABS ⋅ Antonio Pirozzi, Antonis Terefos, Idan Weizman
Sanctions be Damned | From Dridex To Macaw, The Evolution of Evil Corp
Dridex FriedEx Hades Phoenix Locker WastedLocker
2022-01-05 ⋅ ARMOR ⋅ Armor
Threat Intelligence Report: The Evolution of Doppel Spider from BitPaymer to Grief Ransomware
DoppelPaymer FriedEx
2021-08-15 ⋅ Symantec ⋅ Threat Hunter Team
The Ransomware Threat
Babuk BlackMatter DarkSide Avaddon Babuk BADHATCH BazarBackdoor BlackMatter Clop Cobalt Strike Conti DarkSide DoppelPaymer Egregor Emotet FiveHands FriedEx Hades IcedID LockBit Maze MegaCortex MimiKatz QakBot RagnarLocker REvil Ryuk TrickBot WastedLocker
2021-08-05 ⋅ KrebsOnSecurity ⋅ Brian Krebs
Ransomware Gangs and the Name Game Distraction
DarkSide RansomEXX Babuk Cerber Conti DarkSide DoppelPaymer Egregor FriedEx Gandcrab Hermes Maze RansomEXX REvil Ryuk Sekhmet
2021-06-06 ⋅ Bleeping Computer ⋅ Lawrence Abrams
New Evil Corp ransomware mimics PayloadBin gang to evade US sanctions
Babuk FriedEx PayloadBIN WastedLocker
2021-03-17 ⋅ CrowdStrike ⋅ Adam Podlosky, Brendon Feeley
INDRIK SPIDER Supersedes WastedLocker with Hades Ransomware to Circumvent OFAC Sanctions
FriedEx WastedLocker
2021-02-28 ⋅ PWC UK ⋅ PWC UK
Cyber Threats 2020: A Year in Retrospect
elf.wellmess FlowerPower PowGoop 8.t Dropper Agent.BTZ Agent Tesla Appleseed Ave Maria Bankshot BazarBackdoor BLINDINGCAN Chinoxy Conti Cotx RAT Crimson RAT DUSTMAN Emotet FriedEx FunnyDream Hakbit Mailto Maze METALJACK Nefilim Oblique RAT Pay2Key PlugX QakBot REvil Ryuk StoneDrill StrongPity SUNBURST SUPERNOVA TrickBot TurlaRPC Turla SilentMoon WastedLocker WellMess Winnti ZeroCleare APT10 APT23 APT27 APT31 APT41 BlackTech BRONZE EDGEWOOD Inception Framework MUSTANG PANDA Red Charon Red Nue Sea Turtle Tonto Team
2021-02-02 ⋅ ⋅ CRONUP ⋅ Germán Fernández
De ataque con Malware a incidente de Ransomware
Avaddon BazarBackdoor Buer Clop Cobalt Strike Conti DanaBot Dharma Dridex Egregor Emotet Empire Downloader FriedEx GootKit IcedID MegaCortex Nemty Phorpiex PwndLocker PyXie QakBot RansomEXX REvil Ryuk SDBbot SmokeLoader TrickBot Zloader
2021-01-01 ⋅ SecureWorks
Threat Profile: GOLD DRAKE
Cobalt Strike Dridex FriedEx Koadic MimiKatz WastedLocker Evil Corp
2020-11-20 ⋅ ZDNet ⋅ Catalin Cimpanu
The malware that usually installs ransomware and you need to remove right away
Avaddon BazarBackdoor Buer Clop Cobalt Strike Conti DoppelPaymer Dridex Egregor Emotet FriedEx MegaCortex Phorpiex PwndLocker QakBot Ryuk SDBbot TrickBot Zloader
2020-09-29 ⋅ PWC UK ⋅ Andy Auld
What's behind the increase in ransomware attacks this year?
DarkSide Avaddon Clop Conti DoppelPaymer Dridex Emotet FriedEx Mailto PwndLocker QakBot REvil Ryuk SMAUG SunCrypt TrickBot WastedLocker
2020-09-25 ⋅ CrowdStrike ⋅ The Crowdstrike Intel Team
Double Trouble: Ransomware with Data Leak Extortion, Part 1
DoppelPaymer FriedEx LockBit Maze MedusaLocker RagnarLocker REvil RobinHood SamSam WastedLocker MIMIC SPIDER PIZZO SPIDER TA2101 VIKING SPIDER
2020-08-01 ⋅ Temple University ⋅ CARE
Critical Infrastructure Ransomware Attacks
CryptoLocker Cryptowall DoppelPaymer FriedEx Mailto Maze REvil Ryuk SamSam WannaCryptor
2020-07-17 ⋅ CERT-FR ⋅ CERT-FR
The Malware Dridex: Origins and Uses
Andromeda CryptoLocker Cutwail DoppelPaymer Dridex Emotet FriedEx Gameover P2P Gandcrab ISFB Murofet Necurs Predator The Thief Zeus
2020-03-04 ⋅ CrowdStrike ⋅ CrowdStrike
2020 CrowdStrike Global Threat Report
MESSAGETAP More_eggs 8.t Dropper Anchor BabyShark BadNews Clop Cobalt Strike CobInt Cobra Carbon System Cutwail DanaBot Dharma DoppelDridex DoppelPaymer Dridex Emotet FlawedAmmyy FriedEx Gandcrab Get2 IcedID ISFB KerrDown LightNeuron LockerGoga Maze MECHANICAL Necurs Nokki Outlook Backdoor Phobos Predator The Thief QakBot REvil RobinHood Ryuk SDBbot Skipper SmokeLoader TerraRecon TerraStealer TerraTV TinyLoader TrickBot Vidar Winnti ANTHROPOID SPIDER APT23 APT31 APT39 APT40 BlackTech BuhTrap Charming Kitten CLOCKWORK SPIDER DOPPEL SPIDER FIN7 Gamaredon Group GOBLIN PANDA MONTY SPIDER MUSTANG PANDA NARWHAL SPIDER NOCTURNAL SPIDER PINCHY SPIDER SALTY SPIDER SCULLY SPIDER SMOKY SPIDER Thrip VENOM SPIDER VICEROY TIGER
2020-03-03 ⋅ PWC UK ⋅ PWC UK
Cyber Threats 2019:A Year in Retrospect
KevDroid MESSAGETAP magecart AndroMut Cobalt Strike CobInt Crimson RAT DNSpionage Dridex Dtrack Emotet FlawedAmmyy FlawedGrace FriedEx Gandcrab Get2 GlobeImposter Grateful POS ISFB Kazuar LockerGoga Nokki QakBot Ramnit REvil Rifdoor RokRAT Ryuk shadowhammer ShadowPad Shifu Skipper StoneDrill Stuxnet TrickBot Winnti ZeroCleare APT41 MUSTANG PANDA Sea Turtle
2020-02-25 ⋅ RSA Conference ⋅ Joel DeCapua
Feds Fighting Ransomware: How the FBI Investigates and How You Can Help
FastCash Cerber Defray Dharma FriedEx Gandcrab GlobeImposter Mamba Phobos Rapid Ransom REvil Ryuk SamSam Zeus
2020-02-25 ⋅ Bleeping Computer ⋅ Lawrence Abrams
DoppelPaymer Ransomware Launches Site to Post Victim's Data
DoppelPaymer FriedEx
2020-02-12 ⋅ McAfee ⋅ Christiaan Beek
CSI: Evidence Indicators for Targeted Ransomware Attacks – Part I
FriedEx
2020-01-29 ⋅ ANSSI ⋅ ANSSI
État de la menace rançongiciel
Clop Dharma FriedEx Gandcrab LockerGoga Maze MegaCortex REvil RobinHood Ryuk SamSam
2020-01-17 ⋅ Secureworks ⋅ Keita Yamazaki, Tamada Kiyotaka, You Nakatsuru
Is It Wrong to Try to Find APT Techniques in Ransomware Attack?
Defray Dharma FriedEx Gandcrab GlobeImposter Matrix Ransom MedusaLocker Phobos REvil Ryuk SamSam Scarab Ransomware
2020-01-01 ⋅ Secureworks ⋅ SecureWorks
GOLD DRAKE
Dridex Empire Downloader FriedEx Koadic MimiKatz
2019-11-06 ⋅ Blueliv ⋅ Blueliv Team, Jose Miguel Esparza
Spanish consultancy Everis suffers BitPaymer ransomware attack: a brief analysis
FriedEx
2019-10-21 ⋅ ⋅ ANSSI ⋅ ANSSI
SUMMARY OF THE BITPAYMER/IENCRYPT RANSOMWARE
FriedEx
2019-10-21 ⋅ ANSSI ⋅ ANSSI
BITPAYMER/IENCRYPT RANSOMWARE
FriedEx
2019-07-12 ⋅ CrowdStrike ⋅ Bex Hartley, Brett Stone-Gross, Sergei Frankoff
BitPaymer Source Code Fork: Meet DoppelPaymer Ransomware and Dridex 2.0
DoppelDridex DoppelPaymer Dridex FriedEx
2019-04-15 ⋅ Trend Micro ⋅ Gilbert Sison, Ryan Maglaque
Account With Admin Privileges Abused to Install BitPaymer Ransomware via PsExec
FriedEx
2018-12-18 ⋅ Trend Micro ⋅ Trendmicro
URSNIF, EMOTET, DRIDEX and BitPaymer Gangs Linked by a Similar Loader
Dridex Emotet FriedEx ISFB
2018-11-14 ⋅ CrowdStrike ⋅ Bex Hartley, Sergei Frankoff
Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware
FriedEx INDRIK SPIDER
2018-09-11 ⋅ Sophos Naked Security ⋅ Mark Stockley
The Rise of Targeted Ransomware
Dharma FriedEx SamSam
2018-01-26 ⋅ ESET Research ⋅ Michal Poslušný
FriedEx: BitPaymer ransomware the work of Dridex authors
Dridex FriedEx
Yara Rules
[TLP:WHITE] win_friedex_auto (20260917 | Detects win.friedex.)
rule win_friedex_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.friedex."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.friedex"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 57 6a2a 5f 6a3f 5b 6a02 }
            // n = 6, score = 800
            //   57                   | push                edi
            //   6a2a                 | push                0x2a
            //   5f                   | pop                 edi
            //   6a3f                 | push                0x3f
            //   5b                   | pop                 ebx
            //   6a02                 | push                2

        $sequence_1 = { 8bd8 8d7102 eb1d 32c0 eb39 663bfa 7410 }
            // n = 7, score = 800
            //   8bd8                 | mov                 ebx, eax
            //   8d7102               | lea                 esi, [ecx + 2]
            //   eb1d                 | jmp                 0x1f
            //   32c0                 | xor                 al, al
            //   eb39                 | jmp                 0x3b
            //   663bfa               | cmp                 di, dx
            //   7410                 | je                  0x12

        $sequence_2 = { 8bc8 e8???????? 57 8bc8 e8???????? 6a26 }
            // n = 6, score = 800
            //   8bc8                 | mov                 ecx, eax
            //   e8????????           |                     
            //   57                   | push                edi
            //   8bc8                 | mov                 ecx, eax
            //   e8????????           |                     
            //   6a26                 | push                0x26

        $sequence_3 = { 663bf7 7416 663bf2 7405 663bf3 }
            // n = 5, score = 800
            //   663bf7               | cmp                 si, di
            //   7416                 | je                  0x18
            //   663bf2               | cmp                 si, dx
            //   7405                 | je                  7
            //   663bf3               | cmp                 si, bx

        $sequence_4 = { 663938 74f9 33c9 663908 0f94c0 }
            // n = 5, score = 800
            //   663938               | cmp                 word ptr [eax], di
            //   74f9                 | je                  0xfffffffb
            //   33c9                 | xor                 ecx, ecx
            //   663908               | cmp                 word ptr [eax], cx
            //   0f94c0               | sete                al

        $sequence_5 = { 8bda 0fb711 6685d2 744a 0fb738 663b7c2410 7514 }
            // n = 7, score = 800
            //   8bda                 | mov                 ebx, edx
            //   0fb711               | movzx               edx, word ptr [ecx]
            //   6685d2               | test                dx, dx
            //   744a                 | je                  0x4c
            //   0fb738               | movzx               edi, word ptr [eax]
            //   663b7c2410           | cmp                 di, word ptr [esp + 0x10]
            //   7514                 | jne                 0x16

        $sequence_6 = { 5b 6a02 897c2414 5d eb16 }
            // n = 5, score = 800
            //   5b                   | pop                 ebx
            //   6a02                 | push                2
            //   897c2414             | mov                 dword ptr [esp + 0x14], edi
            //   5d                   | pop                 ebp
            //   eb16                 | jmp                 0x18

        $sequence_7 = { c20400 8b4c2404 8d44240c 50 ff74240c e8???????? 8b442404 }
            // n = 7, score = 800
            //   c20400               | ret                 4
            //   8b4c2404             | mov                 ecx, dword ptr [esp + 4]
            //   8d44240c             | lea                 eax, [esp + 0xc]
            //   50                   | push                eax
            //   ff74240c             | push                dword ptr [esp + 0xc]
            //   e8????????           |                     
            //   8b442404             | mov                 eax, dword ptr [esp + 4]

        $sequence_8 = { e8???????? 8d0d4430a500 31d2 8b75f8 89461c }
            // n = 5, score = 100
            //   e8????????           |                     
            //   8d0d4430a500         | lea                 ecx, [0xa53044]
            //   31d2                 | xor                 edx, edx
            //   8b75f8               | mov                 esi, dword ptr [ebp - 8]
            //   89461c               | mov                 dword ptr [esi + 0x1c], eax

        $sequence_9 = { 83c414 5b 5d c3 8b45f0 8b0c850440a500 }
            // n = 6, score = 100
            //   83c414               | add                 esp, 0x14
            //   5b                   | pop                 ebx
            //   5d                   | pop                 ebp
            //   c3                   | ret                 
            //   8b45f0               | mov                 eax, dword ptr [ebp - 0x10]
            //   8b0c850440a500       | mov                 ecx, dword ptr [eax*4 + 0xa54004]

        $sequence_10 = { 53 83ec54 8d055a23a500 31c9 8d55d8 803d????????e9 8955d4 }
            // n = 7, score = 100
            //   53                   | push                ebx
            //   83ec54               | sub                 esp, 0x54
            //   8d055a23a500         | lea                 eax, [0xa5235a]
            //   31c9                 | xor                 ecx, ecx
            //   8d55d8               | lea                 edx, [ebp - 0x28]
            //   803d????????e9       |                     
            //   8955d4               | mov                 dword ptr [ebp - 0x2c], edx

        $sequence_11 = { 8d055a23a500 5d c3 55 89e5 56 57 }
            // n = 7, score = 100
            //   8d055a23a500         | lea                 eax, [0xa5235a]
            //   5d                   | pop                 ebp
            //   c3                   | ret                 
            //   55                   | push                ebp
            //   89e5                 | mov                 ebp, esp
            //   56                   | push                esi
            //   57                   | push                edi

        $sequence_12 = { e8???????? 8d0da030a500 890424 894c2404 e8???????? 8d0d4430a500 }
            // n = 6, score = 100
            //   e8????????           |                     
            //   8d0da030a500         | lea                 ecx, [0xa530a0]
            //   890424               | mov                 dword ptr [esp], eax
            //   894c2404             | mov                 dword ptr [esp + 4], ecx
            //   e8????????           |                     
            //   8d0d4430a500         | lea                 ecx, [0xa53044]

        $sequence_13 = { c744240400000000 8945f4 8955f0 e8???????? 8d0da030a500 890424 }
            // n = 6, score = 100
            //   c744240400000000     | mov                 dword ptr [esp + 4], 0
            //   8945f4               | mov                 dword ptr [ebp - 0xc], eax
            //   8955f0               | mov                 dword ptr [ebp - 0x10], edx
            //   e8????????           |                     
            //   8d0da030a500         | lea                 ecx, [0xa530a0]
            //   890424               | mov                 dword ptr [esp], eax

        $sequence_14 = { 31d2 8a2c057530a500 83c001 38e9 }
            // n = 4, score = 100
            //   31d2                 | xor                 edx, edx
            //   8a2c057530a500       | mov                 ch, byte ptr [eax + 0xa53075]
            //   83c001               | add                 eax, 1
            //   38e9                 | cmp                 cl, ch

        $sequence_15 = { 894628 890c24 c744240400000000 8955dc e8???????? 8d0de830a500 890424 }
            // n = 7, score = 100
            //   894628               | mov                 dword ptr [esi + 0x28], eax
            //   890c24               | mov                 dword ptr [esp], ecx
            //   c744240400000000     | mov                 dword ptr [esp + 4], 0
            //   8955dc               | mov                 dword ptr [ebp - 0x24], edx
            //   e8????????           |                     
            //   8d0de830a500         | lea                 ecx, [0xa530e8]
            //   890424               | mov                 dword ptr [esp], eax

    condition:
        7 of them and filesize < 204800
}
[TLP:WHITE] win_friedex_w0   (20200304 | BitPaymer Payload)
/*
# Copyright (C) 2019 Kevin O'Reilly (kevoreilly@gmail.com)
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
*/

rule win_friedex_w0 {
    meta:
        author = "kevoreilly"
        description = "BitPaymer Payload"
        source = "https://github.com/ctxis/CAPE/blob/a67579f409828928005fc55cfdaae1b5199ea1db/data/yara/CAPE/BitPaymer.yar"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.friedex"
        malpedia_version = "20200304"
        malpedia_sharing = "TLP:WHITE"
        malpedia_license = ""
    strings:
        $decrypt32 = {6A 40 58 3B C8 0F 4D C1 39 46 04 7D 50 53 57 8B F8 81 E7 3F 00 00 80 79 05 4F 83 CF C0 47 F7 DF 99 1B FF 83 E2 3F 03 C2 F7 DF C1 F8 06 03 F8 C1 E7 06 57}
        $antidefender = "TouchMeNot" wide
    condition:
        uint16(0) == 0x5A4D and all of them
}
Download all Yara Rules