Overview

overview

10

Static

static

3

3bd8144851...18.dll

windows7-x64

10

3bd8144851...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3bd8144851f4857db348d22c0dc0bc6f_JaffaCakes118

  • Size

    1.2MB

  • Sample

    240729-h2mzfssdkb

  • MD5

    3bd8144851f4857db348d22c0dc0bc6f

  • SHA1

    ff49a2d6eedd179f833dfc87b2619e4efd8693de

  • SHA256

    3789a7798897d96799d28d97a5f1339a0af8676a83a7890bbb9bb47e04cc3663

  • SHA512

    3487b252c1da71aeff36078f1188cac85587b5c7cbc7ef9a18deb526783141bcc4c42118f33e632fca55aced082bd9f9c546794c861d17a9668fdb16309ee4c9

  • SSDEEP

    24576:SuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:69cKrUqZWLAcU

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      3bd8144851f4857db348d22c0dc0bc6f_JaffaCakes118

    • Size

      1.2MB

    • MD5

      3bd8144851f4857db348d22c0dc0bc6f

    • SHA1

      ff49a2d6eedd179f833dfc87b2619e4efd8693de

    • SHA256

      3789a7798897d96799d28d97a5f1339a0af8676a83a7890bbb9bb47e04cc3663

    • SHA512

      3487b252c1da71aeff36078f1188cac85587b5c7cbc7ef9a18deb526783141bcc4c42118f33e632fca55aced082bd9f9c546794c861d17a9668fdb16309ee4c9

    • SSDEEP

      24576:SuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:69cKrUqZWLAcU

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks