Extracted

• • Target

    d594e8a2098a81c9bfa24f3c17c992e6_JaffaCakes118

  • Size

    734KB

  • MD5

    d594e8a2098a81c9bfa24f3c17c992e6

  • SHA1

    b9c820973407c7b4bef5b9ce98b7af62cafa397d

  • SHA256

    fad001d463e892e7844040cabdcfa8f8431c07e7ef1ffd76ffbd190f49d7693d

  • SHA512

    50049d1ded3f8cfcb6aa839c0341e91bb39b46dbd5376533f2725ce27e6ae5059d3f5af71100dd025b03b7a3cf90bfa920a93818ac1bafb30c65460514c4fd47

  • SSDEEP

    12288:EY20AljdZgBPfKfi1leppjfQxAogJfqsUsz0cX0rLfGLEXTMd8MQ5B5rxVCz:Z20gPgFKLfQxAVBbIcXQGL+MWMwTrxMz

  Score

  10^/10

  dridex10555botnetdiscoveryevasion

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    botnetdridex

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2