Overview

overview

10

Static

static

3

edbc2bb8ff...18.dll

windows7-x64

10

edbc2bb8ff...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    edbc2bb8ff32ba555d9ecfb4ebe4336d_JaffaCakes118

  • Size

    1.2MB

  • Sample

    240920-q81g5azcrc

  • MD5

    edbc2bb8ff32ba555d9ecfb4ebe4336d

  • SHA1

    30fa3d1d4d7f4993667d2717a8fcd8fa27ba9656

  • SHA256

    4128d0f84d420bcd7d2b648660b3cae21bcbf088e8a82f225b65acf95de78d98

  • SHA512

    0ed34499393e76d87da9c227a755086147720d36e358bbefe8e0167cbeb7927b843202ba35e8d9eb86da25324c89511d8b4891da46fb59e01dc3a1cd660ee28e

  • SSDEEP

    24576:GuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9NHt:m9cKrUqZWLAcU

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      edbc2bb8ff32ba555d9ecfb4ebe4336d_JaffaCakes118

    • Size

      1.2MB

    • MD5

      edbc2bb8ff32ba555d9ecfb4ebe4336d

    • SHA1

      30fa3d1d4d7f4993667d2717a8fcd8fa27ba9656

    • SHA256

      4128d0f84d420bcd7d2b648660b3cae21bcbf088e8a82f225b65acf95de78d98

    • SHA512

      0ed34499393e76d87da9c227a755086147720d36e358bbefe8e0167cbeb7927b843202ba35e8d9eb86da25324c89511d8b4891da46fb59e01dc3a1cd660ee28e

    • SSDEEP

      24576:GuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9NHt:m9cKrUqZWLAcU

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks