Overview

overview

10

Static

static

3

35402b3c98...18.dll

windows7-x64

10

35402b3c98...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    35402b3c982a44a776ba3dd4be28b519_JaffaCakes118

  • Size

    1.3MB

  • Sample

    241011-rpcgmasakq

  • MD5

    35402b3c982a44a776ba3dd4be28b519

  • SHA1

    7a274533a4fea0f23671f61e6b81ad52495a86cb

  • SHA256

    95fbd267e006535acc4bd1284e17c966f7862332aa3978e7008db0113e339616

  • SHA512

    713ba3d9c712d64be42845d5b15c0014e3db2025eba7efb8ea977b4e68fa61d85afc006f1afeeed5f2fed61d33fd24fe2e22c112cbf83e99d1cf48b110eaba25

  • SSDEEP

    12288:sdMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:eMIJxSDX3bqjhcfHk7MzH6z

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      35402b3c982a44a776ba3dd4be28b519_JaffaCakes118

    • Size

      1.3MB

    • MD5

      35402b3c982a44a776ba3dd4be28b519

    • SHA1

      7a274533a4fea0f23671f61e6b81ad52495a86cb

    • SHA256

      95fbd267e006535acc4bd1284e17c966f7862332aa3978e7008db0113e339616

    • SHA512

      713ba3d9c712d64be42845d5b15c0014e3db2025eba7efb8ea977b4e68fa61d85afc006f1afeeed5f2fed61d33fd24fe2e22c112cbf83e99d1cf48b110eaba25

    • SSDEEP

      12288:sdMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:eMIJxSDX3bqjhcfHk7MzH6z

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Dridex payload

      Detects Dridex x64 core DLL in memory.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks