Overview

overview

10

Static

static

3

26c86a299c...d9.dll

windows7-x64

10

26c86a299c...d9.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    26c86a299c2aa7f3db082b5b3769df68c7b6372909473112b6f17969113579d9

  • Size

    700KB

  • Sample

    241014-vzvmqswhqf

  • MD5

    eaad0504af393af4c5f770f1f921df14

  • SHA1

    dedc04982b2d2728d5d11eb4f99d870ad89e1381

  • SHA256

    26c86a299c2aa7f3db082b5b3769df68c7b6372909473112b6f17969113579d9

  • SHA512

    27329a5f0f89fc395320c1f1e1f9177e8a296dbc7125119760bdec56fee37e177685759b5ae8bec632ae4876dbc725b89c7ec8ffa40f9f97a6ee7214e9154dd8

  • SSDEEP

    12288:tqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:tqGBHTxvt+g2gYed

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      26c86a299c2aa7f3db082b5b3769df68c7b6372909473112b6f17969113579d9

    • Size

      700KB

    • MD5

      eaad0504af393af4c5f770f1f921df14

    • SHA1

      dedc04982b2d2728d5d11eb4f99d870ad89e1381

    • SHA256

      26c86a299c2aa7f3db082b5b3769df68c7b6372909473112b6f17969113579d9

    • SHA512

      27329a5f0f89fc395320c1f1e1f9177e8a296dbc7125119760bdec56fee37e177685759b5ae8bec632ae4876dbc725b89c7ec8ffa40f9f97a6ee7214e9154dd8

    • SSDEEP

      12288:tqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:tqGBHTxvt+g2gYed

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Dridex payload

      Detects Dridex x64 core DLL in memory.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks