Overview

overview

10

Static

static

3

dd4291c04d...18.dll

windows7-x64

10

dd4291c04d...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dd4291c04dcea049af1211bed4fbff12_JaffaCakes118

  • Size

    1.2MB

  • Sample

    240912-3sa9hssfpb

  • MD5

    dd4291c04dcea049af1211bed4fbff12

  • SHA1

    99c7c1882b1adbdca93d40b6d1bb670abe21cec0

  • SHA256

    16e713fc83ba72915d16505d5350d1ecc99f13b3cf71b714da0471a8272ce5b5

  • SHA512

    db7107eddb7b2291f936c3bbb3cf7a40239b6b4a041abad9707b5b0479bf6aa58d40be60647c01bd8ba05f8a7128f1d635cdaf8ebda70423e96a77f534a38339

  • SSDEEP

    24576:ruYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N0:19cKrUqZWLAcU

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      dd4291c04dcea049af1211bed4fbff12_JaffaCakes118

    • Size

      1.2MB

    • MD5

      dd4291c04dcea049af1211bed4fbff12

    • SHA1

      99c7c1882b1adbdca93d40b6d1bb670abe21cec0

    • SHA256

      16e713fc83ba72915d16505d5350d1ecc99f13b3cf71b714da0471a8272ce5b5

    • SHA512

      db7107eddb7b2291f936c3bbb3cf7a40239b6b4a041abad9707b5b0479bf6aa58d40be60647c01bd8ba05f8a7128f1d635cdaf8ebda70423e96a77f534a38339

    • SSDEEP

      24576:ruYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N0:19cKrUqZWLAcU

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks