Overview

overview

10

Static

static

3

3d8aaef7ac...0N.dll

windows7-x64

10

3d8aaef7ac...0N.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3d8aaef7ac5e11347cccaf0609c0a340N.exe

  • Size

    892KB

  • Sample

    240830-z3zhbawdnd

  • MD5

    3d8aaef7ac5e11347cccaf0609c0a340

  • SHA1

    804e66f0e767d99513fee66120a02cf34c99c563

  • SHA256

    f2d3547486c1256d9dee8136cb89334f3850dd225c50af407f9f6fb66745d997

  • SHA512

    b2d86426d7e485d14dfa7ac9080ef36d8141e7e55d04aa11cc94a8238998e5c6cff80bc1644052d87e9a4ab542fd4feedf7e2b5a1b02558a4f21a4872b300dee

  • SSDEEP

    12288:VGVNJAvuPFUl/faxmVlBLXKCgFfEK7JRLeHlX//ve7:43JAvRl/fKQKCgFfx4P/va

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      3d8aaef7ac5e11347cccaf0609c0a340N.exe

    • Size

      892KB

    • MD5

      3d8aaef7ac5e11347cccaf0609c0a340

    • SHA1

      804e66f0e767d99513fee66120a02cf34c99c563

    • SHA256

      f2d3547486c1256d9dee8136cb89334f3850dd225c50af407f9f6fb66745d997

    • SHA512

      b2d86426d7e485d14dfa7ac9080ef36d8141e7e55d04aa11cc94a8238998e5c6cff80bc1644052d87e9a4ab542fd4feedf7e2b5a1b02558a4f21a4872b300dee

    • SSDEEP

      12288:VGVNJAvuPFUl/faxmVlBLXKCgFfEK7JRLeHlX//ve7:43JAvRl/fKQKCgFfx4P/va

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks