Overview

overview

10

Static

static

3

e11bf282fd...18.dll

windows7-x64

10

e11bf282fd...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e11bf282fd9be970031baf9797a1379a_JaffaCakes118

  • Size

    991KB

  • Sample

    240914-1p9lssybrr

  • MD5

    e11bf282fd9be970031baf9797a1379a

  • SHA1

    1f7d6162e6ded5db6199dfb1274c2849a0a48657

  • SHA256

    32e5d40ccc266ccfb480fce21f10220a42dcf29b437685b9355b013aa4df6e05

  • SHA512

    886a68d0ad35357c25dd0511d8a9b84eb06a46a499b7e6c28ab4a5300f0c31ae4a598456b6e49648db1b01beaaf76730536336a35f675d134af71ed1723e263b

  • SSDEEP

    24576:hVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:hV8hf6STw1ZlQauvzSq01ICe6zvm

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      e11bf282fd9be970031baf9797a1379a_JaffaCakes118

    • Size

      991KB

    • MD5

      e11bf282fd9be970031baf9797a1379a

    • SHA1

      1f7d6162e6ded5db6199dfb1274c2849a0a48657

    • SHA256

      32e5d40ccc266ccfb480fce21f10220a42dcf29b437685b9355b013aa4df6e05

    • SHA512

      886a68d0ad35357c25dd0511d8a9b84eb06a46a499b7e6c28ab4a5300f0c31ae4a598456b6e49648db1b01beaaf76730536336a35f675d134af71ed1723e263b

    • SSDEEP

      24576:hVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:hV8hf6STw1ZlQauvzSq01ICe6zvm

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks