Overview

overview

10

Static

static

3

a908ca5262...18.dll

windows7-x64

10

a908ca5262...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a908ca52629cfab8057cb8d662b488b1_JaffaCakes118

  • Size

    909KB

  • Sample

    240819-bvwjpawgpc

  • MD5

    a908ca52629cfab8057cb8d662b488b1

  • SHA1

    29d811439833907b69f1a6c2b09c95f499f52038

  • SHA256

    139721b2a97521b2eea00f077fd1e95eb0859296937b1579b0223e8e16b5c628

  • SHA512

    a2bb59d5211b2e08e4b277c78c9470580828726efcf39548a7b6b9ca51afa12c487abdfbd7762f45b2f7be2bdad357d9026c2a59f8558625c36f1508cf8db29b

  • SSDEEP

    12288:Late3r/6VSBuehNcvwh8zqv8gxLBkVHUR8LlRYchYN7QBAs2bh:LN3r/fHhSv3zqvRLBCHUyj7BA

Score
10/10
dridexbotnetevasionloaderpayloadpersistencetrojan

Malware Config

Targets

    • Target

      a908ca52629cfab8057cb8d662b488b1_JaffaCakes118

    • Size

      909KB

    • MD5

      a908ca52629cfab8057cb8d662b488b1

    • SHA1

      29d811439833907b69f1a6c2b09c95f499f52038

    • SHA256

      139721b2a97521b2eea00f077fd1e95eb0859296937b1579b0223e8e16b5c628

    • SHA512

      a2bb59d5211b2e08e4b277c78c9470580828726efcf39548a7b6b9ca51afa12c487abdfbd7762f45b2f7be2bdad357d9026c2a59f8558625c36f1508cf8db29b

    • SSDEEP

      12288:Late3r/6VSBuehNcvwh8zqv8gxLBkVHUR8LlRYchYN7QBAs2bh:LN3r/fHhSv3zqvRLBCHUyj7BA

    Score
    10/10
    dridexbotnetevasionloaderpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Loader 'dmod' strings

      Detects 'dmod' strings in Dridex loader.

      botnetloader

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks