Overview

overview

10

Static

static

XmlLite.dll

windows7_x64

10

XmlLite.dll

windows10_x64

10

Resubmissions

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XmlLite.dll

  • Size

    972KB

  • Sample

    200714-a7gpqcllfn

  • MD5

    a55f44aacfb66d6494db7b94f6a170e4

  • SHA1

    f181f65e6c147b046ba6dfaffa89d7ec45ce674d

  • SHA256

    c08e237f028ef67db6139e16aa4084c8cbada6ce15406819110bb22db01b406e

  • SHA512

    0133d75cbffb9ed1127f70c86dfef7544a5e2d731d0f60030e1578e73025aa155415e23d32f0755c421059056f9030de2af8240b338008c7fcccc6c28ecaa3d4

Score
10/10
dridexbotnetevasionloaderpersistencetrojan

Malware Config

Targets

    • Target

      XmlLite.dll

    • Size

      972KB

    • MD5

      a55f44aacfb66d6494db7b94f6a170e4

    • SHA1

      f181f65e6c147b046ba6dfaffa89d7ec45ce674d

    • SHA256

      c08e237f028ef67db6139e16aa4084c8cbada6ce15406819110bb22db01b406e

    • SHA512

      0133d75cbffb9ed1127f70c86dfef7544a5e2d731d0f60030e1578e73025aa155415e23d32f0755c421059056f9030de2af8240b338008c7fcccc6c28ecaa3d4

    Score
    10/10
    dridexbotnetevasionloaderpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

      botnetloader

    • Dridex Loader 'dmod' strings

      Detects 'dmod' strings in Dridex loader.

      botnetloader

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks