Overview

overview

10

Static

static

3

4af88f0bf5...eb.dll

windows7-x64

10

4af88f0bf5...eb.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4af88f0bf58a337253e7ef9a79dc197102c9e3b2f156b0d5a54998d514ee3eeb

  • Size

    700KB

  • Sample

    241014-v1eyns1bpm

  • MD5

    6bd456cfeba026cd573f86e5531ea384

  • SHA1

    66a88b459322450c073b8c4626f9967e951775c5

  • SHA256

    4af88f0bf58a337253e7ef9a79dc197102c9e3b2f156b0d5a54998d514ee3eeb

  • SHA512

    a35d4de20a6d51f668e08509255b7ba6ae8085170118c23f65202eb22d7687ae1474a29227f57410e146ca3ab27397d86329acfb08c48806308665f561943f3a

  • SSDEEP

    12288:pqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:pqGBHTxvt+g2gYed

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      4af88f0bf58a337253e7ef9a79dc197102c9e3b2f156b0d5a54998d514ee3eeb

    • Size

      700KB

    • MD5

      6bd456cfeba026cd573f86e5531ea384

    • SHA1

      66a88b459322450c073b8c4626f9967e951775c5

    • SHA256

      4af88f0bf58a337253e7ef9a79dc197102c9e3b2f156b0d5a54998d514ee3eeb

    • SHA512

      a35d4de20a6d51f668e08509255b7ba6ae8085170118c23f65202eb22d7687ae1474a29227f57410e146ca3ab27397d86329acfb08c48806308665f561943f3a

    • SSDEEP

      12288:pqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:pqGBHTxvt+g2gYed

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Dridex payload

      Detects Dridex x64 core DLL in memory.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks