Overview

overview

10

Static

static

3

6148532826...bf.dll

windows7-x64

10

6148532826...bf.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6148532826cdbfc9b12295ce641021f22336459ea6f5cd2de43dec5f18e648bf

  • Size

    728KB

  • Sample

    241014-x67xrawcqp

  • MD5

    3a325295832f70c883b27b87efa606c6

  • SHA1

    920e9216016a61f1323024604facdb3fa3d4739a

  • SHA256

    6148532826cdbfc9b12295ce641021f22336459ea6f5cd2de43dec5f18e648bf

  • SHA512

    8908496ecd06be35afaf723601ec8478f8b6d1805bf390f5fbb2301db21d0872b0b63f4dbdfb1f9d03db8ecd721a697a49a6eb79d6d5d3e2f173e3176cc7c05f

  • SSDEEP

    12288:pqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:pqGBHTxvt+g2gYed

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      6148532826cdbfc9b12295ce641021f22336459ea6f5cd2de43dec5f18e648bf

    • Size

      728KB

    • MD5

      3a325295832f70c883b27b87efa606c6

    • SHA1

      920e9216016a61f1323024604facdb3fa3d4739a

    • SHA256

      6148532826cdbfc9b12295ce641021f22336459ea6f5cd2de43dec5f18e648bf

    • SHA512

      8908496ecd06be35afaf723601ec8478f8b6d1805bf390f5fbb2301db21d0872b0b63f4dbdfb1f9d03db8ecd721a697a49a6eb79d6d5d3e2f173e3176cc7c05f

    • SSDEEP

      12288:pqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:pqGBHTxvt+g2gYed

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Dridex payload

      Detects Dridex x64 core DLL in memory.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks