Overview

overview

10

Static

static

3

ac0d85bfe7...18.dll

windows7-x64

10

ac0d85bfe7...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ac0d85bfe7f5dfb252cbd397cf450e04_JaffaCakes118

  • Size

    1.2MB

  • Sample

    240819-wt131aydrc

  • MD5

    ac0d85bfe7f5dfb252cbd397cf450e04

  • SHA1

    c0b7faa33688049c254764a8b918a7643ed1205c

  • SHA256

    b60a23eefd0b5d0fd235560023c71b4370ebd54e66785b7d30647e974ff29ada

  • SHA512

    f6bff5dc86b31140b866b443c9a26f40b907f737611b9a08b70de894a7b3d97d82040d8014071ddc3b6f12c0a83bf053555d1918b1f184bb6b35d3838a0e4d6d

  • SSDEEP

    24576:muYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:G9cKrUqZWLAcU

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      ac0d85bfe7f5dfb252cbd397cf450e04_JaffaCakes118

    • Size

      1.2MB

    • MD5

      ac0d85bfe7f5dfb252cbd397cf450e04

    • SHA1

      c0b7faa33688049c254764a8b918a7643ed1205c

    • SHA256

      b60a23eefd0b5d0fd235560023c71b4370ebd54e66785b7d30647e974ff29ada

    • SHA512

      f6bff5dc86b31140b866b443c9a26f40b907f737611b9a08b70de894a7b3d97d82040d8014071ddc3b6f12c0a83bf053555d1918b1f184bb6b35d3838a0e4d6d

    • SSDEEP

      24576:muYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:G9cKrUqZWLAcU

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks