Overview

overview

10

Static

static

3

d47ce92c9b...18.dll

windows7-x64

10

d47ce92c9b...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d47ce92c9bd45f8eca1b81acbcb25287_JaffaCakes118

  • Size

    986KB

  • Sample

    240908-qycnba1emd

  • MD5

    d47ce92c9bd45f8eca1b81acbcb25287

  • SHA1

    12074d657002ae08f4bac4b2a77c46099d1233da

  • SHA256

    25eebe3e58313adf7b6249667bb2be04934c816dc0ced46c61b4c18f645f57d0

  • SHA512

    20a0b331e3c7b710e0fadf862b4b0b3687564cfe2c24e1ee056b9a7785c6e5c20506db60647d95d8d93d6706956a61f6ac976f534ca8facf42754bf2b2fc3a21

  • SSDEEP

    24576:MVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:MV8hf6STw1ZlQauvzSq01ICe6zvm

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      d47ce92c9bd45f8eca1b81acbcb25287_JaffaCakes118

    • Size

      986KB

    • MD5

      d47ce92c9bd45f8eca1b81acbcb25287

    • SHA1

      12074d657002ae08f4bac4b2a77c46099d1233da

    • SHA256

      25eebe3e58313adf7b6249667bb2be04934c816dc0ced46c61b4c18f645f57d0

    • SHA512

      20a0b331e3c7b710e0fadf862b4b0b3687564cfe2c24e1ee056b9a7785c6e5c20506db60647d95d8d93d6706956a61f6ac976f534ca8facf42754bf2b2fc3a21

    • SSDEEP

      24576:MVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:MV8hf6STw1ZlQauvzSq01ICe6zvm

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks