Overview

overview

10

Static

static

3

882f81e1b0...18.dll

windows7-x64

10

882f81e1b0...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    882f81e1b065d0ee8b1f09e3c0cf5005_JaffaCakes118

  • Size

    1.2MB

  • Sample

    240810-3zk3asygrg

  • MD5

    882f81e1b065d0ee8b1f09e3c0cf5005

  • SHA1

    d0edf3240ba31504894f85af5f0a3cb3d3fe1a8a

  • SHA256

    a6691293ad0620c03ad88d76e5e032d56eb2101dedef76253168e8555eb37514

  • SHA512

    4c89e56f9f8a583601d6f9dd815a4aa7cfbbff4be8cfee2b4ee8f2ff3af0dc9c3ca3bd955ef1aca1d1b979e5aec6e7b1aa3304f1be2eddfe55cd6ba41a5a5a06

  • SSDEEP

    24576:GuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9NSt:m9cKrUqZWLAcU

Score
10/10
dridexbotnetevasionpayloadpersistenceprivilege_escalationtrojan

Malware Config

Targets

    • Target

      882f81e1b065d0ee8b1f09e3c0cf5005_JaffaCakes118

    • Size

      1.2MB

    • MD5

      882f81e1b065d0ee8b1f09e3c0cf5005

    • SHA1

      d0edf3240ba31504894f85af5f0a3cb3d3fe1a8a

    • SHA256

      a6691293ad0620c03ad88d76e5e032d56eb2101dedef76253168e8555eb37514

    • SHA512

      4c89e56f9f8a583601d6f9dd815a4aa7cfbbff4be8cfee2b4ee8f2ff3af0dc9c3ca3bd955ef1aca1d1b979e5aec6e7b1aa3304f1be2eddfe55cd6ba41a5a5a06

    • SSDEEP

      24576:GuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9NSt:m9cKrUqZWLAcU

    Score
    10/10
    dridexbotnetevasionpayloadpersistenceprivilege_escalationtrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks