Overview

overview

10

Static

static

3

c8baf35e81...18.dll

windows7-x64

10

c8baf35e81...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c8baf35e81d9fdc69131c9ceba69f06a_JaffaCakes118

  • Size

    1.2MB

  • Sample

    240829-nklb7ayfkf

  • MD5

    c8baf35e81d9fdc69131c9ceba69f06a

  • SHA1

    ad1495128510e0a7eadda3d4ede0a06c3744a46f

  • SHA256

    21bd6ef058050b15306f88b3ce55c92df07610ac8025a9975c8aaa3a47a53ebf

  • SHA512

    b46cad51d6d6a86609bd120b4b9effe3f715bdc7526682c846bf6301e9c2cfb041b8920301201398059c0385a1152669c7c7d6704599203e24b225ed5d970b9e

  • SSDEEP

    24576:9uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9Nat:X9cKrUqZWLAcU

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      c8baf35e81d9fdc69131c9ceba69f06a_JaffaCakes118

    • Size

      1.2MB

    • MD5

      c8baf35e81d9fdc69131c9ceba69f06a

    • SHA1

      ad1495128510e0a7eadda3d4ede0a06c3744a46f

    • SHA256

      21bd6ef058050b15306f88b3ce55c92df07610ac8025a9975c8aaa3a47a53ebf

    • SHA512

      b46cad51d6d6a86609bd120b4b9effe3f715bdc7526682c846bf6301e9c2cfb041b8920301201398059c0385a1152669c7c7d6704599203e24b225ed5d970b9e

    • SSDEEP

      24576:9uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9Nat:X9cKrUqZWLAcU

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks