Overview

overview

10

Static

static

3

dbb016d718...18.dll

windows7-x64

10

dbb016d718...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dbb016d718263e81da2ebf373f3f4f89_JaffaCakes118

  • Size

    1.2MB

  • Sample

    240912-dfa1jsxfqn

  • MD5

    dbb016d718263e81da2ebf373f3f4f89

  • SHA1

    8e2717cb4a7925963cbbc31ef7601ca42596474a

  • SHA256

    2062fc2f0bab8aafd218ac4a32fe9800beed5f260675fff153d838dd2e4cbe3a

  • SHA512

    5176707394139ab0b29e06db3898b79364e88a6db95be18ac4607346aa241854f5280669810a14d858abf764414eb345b178a2877146ddb100df6b1837dd1fb4

  • SSDEEP

    24576:7VHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8R2:7V8hf6STw1ZlQauvzSq01ICe6zvmh

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      dbb016d718263e81da2ebf373f3f4f89_JaffaCakes118

    • Size

      1.2MB

    • MD5

      dbb016d718263e81da2ebf373f3f4f89

    • SHA1

      8e2717cb4a7925963cbbc31ef7601ca42596474a

    • SHA256

      2062fc2f0bab8aafd218ac4a32fe9800beed5f260675fff153d838dd2e4cbe3a

    • SHA512

      5176707394139ab0b29e06db3898b79364e88a6db95be18ac4607346aa241854f5280669810a14d858abf764414eb345b178a2877146ddb100df6b1837dd1fb4

    • SSDEEP

      24576:7VHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8R2:7V8hf6STw1ZlQauvzSq01ICe6zvmh

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks