Overview

overview

10

Static

static

3

cd52a36ef1...18.dll

windows7-x64

10

cd52a36ef1...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cd52a36ef1f73ebca3e8bbb12b5f4a9c_JaffaCakes118

  • Size

    1.2MB

  • Sample

    240831-wp1axaxfjb

  • MD5

    cd52a36ef1f73ebca3e8bbb12b5f4a9c

  • SHA1

    5f7b23a06b43436f64d30ebeb64936d2816d170a

  • SHA256

    f2f6b3965cee4f171cec6a3e05067252f127e466dd090fe5fd22d957267a2076

  • SHA512

    0c259f41ba031cb19f74faab856f3afb89a7e82d6df0d5de673ef73e8e4d79a35342a314fe722c4dca81f01da60b4e608ef060cf16d2e118eae79ee79174b039

  • SSDEEP

    24576:yuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:a9cKrUqZWLAcU

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      cd52a36ef1f73ebca3e8bbb12b5f4a9c_JaffaCakes118

    • Size

      1.2MB

    • MD5

      cd52a36ef1f73ebca3e8bbb12b5f4a9c

    • SHA1

      5f7b23a06b43436f64d30ebeb64936d2816d170a

    • SHA256

      f2f6b3965cee4f171cec6a3e05067252f127e466dd090fe5fd22d957267a2076

    • SHA512

      0c259f41ba031cb19f74faab856f3afb89a7e82d6df0d5de673ef73e8e4d79a35342a314fe722c4dca81f01da60b4e608ef060cf16d2e118eae79ee79174b039

    • SSDEEP

      24576:yuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:a9cKrUqZWLAcU

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks