dridex | aa794827c5c65b5416d7f2454cb2376816a74c9e0d5d6ed83daadf07ad335ff1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

faff1cecdbec225f5f4a12f2afa66915
Size

1.4MB
Sample

231222-vlmd7sdfg5
MD5

faff1cecdbec225f5f4a12f2afa66915
SHA1

0bc116efeeab88744b461d8c7979c4bade196f55
SHA256

aa794827c5c65b5416d7f2454cb2376816a74c9e0d5d6ed83daadf07ad335ff1
SHA512

83a90171fcd5581fd0747b3d106674c8e2935613fe906cea4dd627f3f6c420810e576a42995dfa670e06dd35c84aca7217dfa14a89c131bedd25797be6ae72c4
SSDEEP

12288:DVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:SfP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Targets

- Target
  
  faff1cecdbec225f5f4a12f2afa66915
- Size
  
  1.4MB
- MD5
  
  faff1cecdbec225f5f4a12f2afa66915
- SHA1
  
  0bc116efeeab88744b461d8c7979c4bade196f55
- SHA256
  
  aa794827c5c65b5416d7f2454cb2376816a74c9e0d5d6ed83daadf07ad335ff1
- SHA512
  
  83a90171fcd5581fd0747b3d106674c8e2935613fe906cea4dd627f3f6c420810e576a42995dfa670e06dd35c84aca7217dfa14a89c131bedd25797be6ae72c4
- SSDEEP
  
  12288:DVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:SfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Score

10^/10

dridex botnet evasion payload persistence trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Shellcode
  Detects Dridex Payload shellcode injected in Explorer process.
  botnet payload
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dridexbotnetevasionpayloadpersistencetrojan

behavioral2

dridexbotnetevasionpayloadpersistencetrojan