Overview

overview

10

Static

static

3

21c141dcb5...18.dll

windows7-x64

10

21c141dcb5...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    21c141dcb53d6e92c947f3fe480a267d_JaffaCakes118

  • Size

    1.2MB

  • Sample

    240728-y495rswhkg

  • MD5

    21c141dcb53d6e92c947f3fe480a267d

  • SHA1

    2d12b1a6bc68b02c4df842f01afb3a0b97a2b901

  • SHA256

    8506a0be38a93d9236db2fbb42a97fc10e6fa42dc77ac6a5ed35476bd30f2574

  • SHA512

    87fb19f6bf66d1c67e43d22c6db0ec22318749cc7be0e9b7e6e5809ec23245bf5f2b96713a3fe8055c7f2cc4174407fe95d285283791655b07d06cff1e3d9b41

  • SSDEEP

    24576:buYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:F9cKrUqZWLAcU

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      21c141dcb53d6e92c947f3fe480a267d_JaffaCakes118

    • Size

      1.2MB

    • MD5

      21c141dcb53d6e92c947f3fe480a267d

    • SHA1

      2d12b1a6bc68b02c4df842f01afb3a0b97a2b901

    • SHA256

      8506a0be38a93d9236db2fbb42a97fc10e6fa42dc77ac6a5ed35476bd30f2574

    • SHA512

      87fb19f6bf66d1c67e43d22c6db0ec22318749cc7be0e9b7e6e5809ec23245bf5f2b96713a3fe8055c7f2cc4174407fe95d285283791655b07d06cff1e3d9b41

    • SSDEEP

      24576:buYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:F9cKrUqZWLAcU

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks