Overview

overview

10

Static

static

3

ca85c8ac9e...18.dll

windows7-x64

10

ca85c8ac9e...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ca85c8ac9e78fff1382072443b979d98_JaffaCakes118

  • Size

    1.2MB

  • Sample

    240830-ksnkqsvhma

  • MD5

    ca85c8ac9e78fff1382072443b979d98

  • SHA1

    ac2624a13f968db008cec1aac51691778b98c743

  • SHA256

    f493377faeb311a801726886346632f0cecb8f6a70547a01b69114192c3caa2a

  • SHA512

    3a273ec1b7b3c81a163bc2a5b4082da83427eaa798c449e34b25f79ca6ea4e84d749f319321604b9871ab4a9dc94b960d0e69a02244b9a44f7544a65bbc9b764

  • SSDEEP

    24576:muYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:G9cKrUqZWLAcU

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      ca85c8ac9e78fff1382072443b979d98_JaffaCakes118

    • Size

      1.2MB

    • MD5

      ca85c8ac9e78fff1382072443b979d98

    • SHA1

      ac2624a13f968db008cec1aac51691778b98c743

    • SHA256

      f493377faeb311a801726886346632f0cecb8f6a70547a01b69114192c3caa2a

    • SHA512

      3a273ec1b7b3c81a163bc2a5b4082da83427eaa798c449e34b25f79ca6ea4e84d749f319321604b9871ab4a9dc94b960d0e69a02244b9a44f7544a65bbc9b764

    • SSDEEP

      24576:muYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:G9cKrUqZWLAcU

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks