Overview

overview

10

Static

static

3

c857bf0ea2...d8.dll

windows7-x64

10

c857bf0ea2...d8.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c857bf0ea218b0898ab1dd5a040f82764e2c425235e47df6e8a397cdad220ed8

  • Size

    964KB

  • Sample

    241011-rjbm5swflh

  • MD5

    f78235c59196a46c2d2e038800bdc8da

  • SHA1

    868b5ae58f59ee0593388dccc5d720328520a76e

  • SHA256

    c857bf0ea218b0898ab1dd5a040f82764e2c425235e47df6e8a397cdad220ed8

  • SHA512

    5e1b7c716d60bac077b642db4eff4b2b5fb62675c8c7cd509803917ebd377e0af770acb64351e54aaa1b01f72b741157b8da13f9efee418157f5396763c56bfb

  • SSDEEP

    12288:9PVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:9tKTrsKSKBTSb6DUXWq8

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      c857bf0ea218b0898ab1dd5a040f82764e2c425235e47df6e8a397cdad220ed8

    • Size

      964KB

    • MD5

      f78235c59196a46c2d2e038800bdc8da

    • SHA1

      868b5ae58f59ee0593388dccc5d720328520a76e

    • SHA256

      c857bf0ea218b0898ab1dd5a040f82764e2c425235e47df6e8a397cdad220ed8

    • SHA512

      5e1b7c716d60bac077b642db4eff4b2b5fb62675c8c7cd509803917ebd377e0af770acb64351e54aaa1b01f72b741157b8da13f9efee418157f5396763c56bfb

    • SSDEEP

      12288:9PVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:9tKTrsKSKBTSb6DUXWq8

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Dridex payload

      Detects Dridex x64 core DLL in memory.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks