dridex | 9896a4f7a5d74708af6fdfc7bde7995dd9242b6c18a6239943c963ed60eeb7b8 | Triage

Sharing

General

Target

9896a4f7a5d74708af6fdfc7bde7995dd9242b6c18a6239943c963ed60eeb7b8
Size

998KB
Sample

220417-t268wadgb8
MD5

c6b8a03ce5ec402adf6a7e40d960b306
SHA1

bdbb9fbe24914344c69086ceeaed355c7715bdfd
SHA256

9896a4f7a5d74708af6fdfc7bde7995dd9242b6c18a6239943c963ed60eeb7b8
SHA512

3bb10b255f3ecc49fcd5cf743857af83b638c923c02c6814649cf3f64c310baa577430c278aac370765fe87bcf497a35141c7fc408c9906c3cba837def16e39f

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Targets

- Target
  
  9896a4f7a5d74708af6fdfc7bde7995dd9242b6c18a6239943c963ed60eeb7b8
- Size
  
  998KB
- MD5
  
  c6b8a03ce5ec402adf6a7e40d960b306
- SHA1
  
  bdbb9fbe24914344c69086ceeaed355c7715bdfd
- SHA256
  
  9896a4f7a5d74708af6fdfc7bde7995dd9242b6c18a6239943c963ed60eeb7b8
- SHA512
  
  3bb10b255f3ecc49fcd5cf743857af83b638c923c02c6814649cf3f64c310baa577430c278aac370765fe87bcf497a35141c7fc408c9906c3cba837def16e39f
Score

10^/10

evasion persistence trojan dridex botnet payload
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Shellcode
  Detects Dridex Payload shellcode injected in Explorer process.
  botnet payload
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

dridexbotnetevasionpayloadpersistencetrojan