Overview

overview

10

Static

static

3

b612fd6158...18.dll

windows7-x64

10

b612fd6158...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b612fd6158326f6573d2c195218b4187_JaffaCakes118

  • Size

    1.2MB

  • Sample

    240822-dbxczsvekb

  • MD5

    b612fd6158326f6573d2c195218b4187

  • SHA1

    8a784d8434dc4ee8a185038e55beeae77169be6e

  • SHA256

    0a5a9a825cdb713862e4db1eeea33b8847e231cc54197c9b4b7b958c70e9c253

  • SHA512

    41fa451ca8ff1d805fa5407174fa0e59a6468017a91a3f2b2a0db6b84cbd26573bbce4788ead48c3fc41e40313886c2ef2237a6e99a9f41b710cf344ba1cb47a

  • SSDEEP

    24576:buYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:F9cKrUqZWLAcU

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      b612fd6158326f6573d2c195218b4187_JaffaCakes118

    • Size

      1.2MB

    • MD5

      b612fd6158326f6573d2c195218b4187

    • SHA1

      8a784d8434dc4ee8a185038e55beeae77169be6e

    • SHA256

      0a5a9a825cdb713862e4db1eeea33b8847e231cc54197c9b4b7b958c70e9c253

    • SHA512

      41fa451ca8ff1d805fa5407174fa0e59a6468017a91a3f2b2a0db6b84cbd26573bbce4788ead48c3fc41e40313886c2ef2237a6e99a9f41b710cf344ba1cb47a

    • SSDEEP

      24576:buYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:F9cKrUqZWLAcU

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks