Overview

overview

10

Static

static

3

183815da44...18.dll

windows7-x64

10

183815da44...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    183815da44d7ed5ae8729924751f4708_JaffaCakes118

  • Size

    1.2MB

  • Sample

    240728-vavw7sxbqb

  • MD5

    183815da44d7ed5ae8729924751f4708

  • SHA1

    814251ed5022db70b1fbc52aa18b04bad3e20a15

  • SHA256

    b02ff992c112d00fcf1259b6ca963384f823e45f0538a91b75c6c2349862dfea

  • SHA512

    f796d19444f9775721369f99a7d00ca31c83deff9df183524b81ed3675dc14e652b5c7af13b4eee7854af9703388ef4c96b6f93594b64d33e1ed7a8c0593a998

  • SSDEEP

    24576:+uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:+9cKrUqZWLAcU

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      183815da44d7ed5ae8729924751f4708_JaffaCakes118

    • Size

      1.2MB

    • MD5

      183815da44d7ed5ae8729924751f4708

    • SHA1

      814251ed5022db70b1fbc52aa18b04bad3e20a15

    • SHA256

      b02ff992c112d00fcf1259b6ca963384f823e45f0538a91b75c6c2349862dfea

    • SHA512

      f796d19444f9775721369f99a7d00ca31c83deff9df183524b81ed3675dc14e652b5c7af13b4eee7854af9703388ef4c96b6f93594b64d33e1ed7a8c0593a998

    • SSDEEP

      24576:+uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:+9cKrUqZWLAcU

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks