Overview

overview

10

Static

static

3

cca80d9e06...18.dll

windows7-x64

10

cca80d9e06...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cca80d9e068acff700587abcb34c5234_JaffaCakes118

  • Size

    1.2MB

  • Sample

    240831-mq3yrazaph

  • MD5

    cca80d9e068acff700587abcb34c5234

  • SHA1

    d9bbd6dfafc80c3a0af3a6814abd237cebdd6c55

  • SHA256

    480819cebdae01d450d58cd97b2a92b70f2ba4b01e92fa3c99add416e1cb4031

  • SHA512

    a9e55710194bb7958b642231466b6ff67be5afcb0081ff6563813be380fbb672a198e70ba5d9b2eee4cc71ba5c5fb7320169d99d03eef574917c43e68d92e2a2

  • SSDEEP

    24576:0uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9Nlpt:s9cKrUqZWLAcU

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      cca80d9e068acff700587abcb34c5234_JaffaCakes118

    • Size

      1.2MB

    • MD5

      cca80d9e068acff700587abcb34c5234

    • SHA1

      d9bbd6dfafc80c3a0af3a6814abd237cebdd6c55

    • SHA256

      480819cebdae01d450d58cd97b2a92b70f2ba4b01e92fa3c99add416e1cb4031

    • SHA512

      a9e55710194bb7958b642231466b6ff67be5afcb0081ff6563813be380fbb672a198e70ba5d9b2eee4cc71ba5c5fb7320169d99d03eef574917c43e68d92e2a2

    • SSDEEP

      24576:0uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9Nlpt:s9cKrUqZWLAcU

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks