Overview

overview

10

Static

static

3

6dbd1df545...76.dll

windows7-x64

10

6dbd1df545...76.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6dbd1df5459b17bb2c9fdb7849e4294657404971ac6495660b29464e4a69e176

  • Size

    724KB

  • Sample

    241014-x3pl1awbmm

  • MD5

    6a6345e39d25621d971721a635aa86e5

  • SHA1

    36c3b301d60b34ebe4b206e1660d496f991a9a1d

  • SHA256

    6dbd1df5459b17bb2c9fdb7849e4294657404971ac6495660b29464e4a69e176

  • SHA512

    1b7cfcb8d052928407cc38126c7001140ed77f07c2162ef79128fef40bc3aea42b38ede6412b9c60e361a6a29cabdcc43d38cdbd83b5191d63d0296f3dde22ee

  • SSDEEP

    12288:JqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:JqGBHTxvt+g2gYed

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      6dbd1df5459b17bb2c9fdb7849e4294657404971ac6495660b29464e4a69e176

    • Size

      724KB

    • MD5

      6a6345e39d25621d971721a635aa86e5

    • SHA1

      36c3b301d60b34ebe4b206e1660d496f991a9a1d

    • SHA256

      6dbd1df5459b17bb2c9fdb7849e4294657404971ac6495660b29464e4a69e176

    • SHA512

      1b7cfcb8d052928407cc38126c7001140ed77f07c2162ef79128fef40bc3aea42b38ede6412b9c60e361a6a29cabdcc43d38cdbd83b5191d63d0296f3dde22ee

    • SSDEEP

      12288:JqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:JqGBHTxvt+g2gYed

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Dridex payload

      Detects Dridex x64 core DLL in memory.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks