Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    c51eaadadae8fa794d29148f358c176f598ee3b7eead0500c3945d0756ecc07b

  • Size

    1.0MB

  • Sample

    230420-teaw6aah53

  • MD5

    e06f6641dd7d292561d7a1a838d89c3d

  • SHA1

    5945d94a879fc90726ec4fd9a473314395e10e83

  • SHA256

    c51eaadadae8fa794d29148f358c176f598ee3b7eead0500c3945d0756ecc07b

  • SHA512

    5030fc374a1aebdd35641195ab831036d6a51869b5f12f7cc308fe19b376c4e9bd0aa83e0c8658cf080dd4daf7930369aa16b0e95bd97381ce12f2a75004c4e8

  • SSDEEP

    24576:Zyxy/SScQERBa4j0nbwIBqHa3P9J+MTs3Nw1E:Mx7fwwIBqHaffF0

Score
10/10
discoveryevasionpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      c51eaadadae8fa794d29148f358c176f598ee3b7eead0500c3945d0756ecc07b

    • Size

      1.0MB

    • MD5

      e06f6641dd7d292561d7a1a838d89c3d

    • SHA1

      5945d94a879fc90726ec4fd9a473314395e10e83

    • SHA256

      c51eaadadae8fa794d29148f358c176f598ee3b7eead0500c3945d0756ecc07b

    • SHA512

      5030fc374a1aebdd35641195ab831036d6a51869b5f12f7cc308fe19b376c4e9bd0aa83e0c8658cf080dd4daf7930369aa16b0e95bd97381ce12f2a75004c4e8

    • SSDEEP

      24576:Zyxy/SScQERBa4j0nbwIBqHa3P9J+MTs3Nw1E:Mx7fwwIBqHaffF0

    Score
    10/10
    discoveryevasionpersistencespywarestealertrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks