Overview

overview

10

Static

static

3

bf4a030404...b6.dll

windows7-x64

10

bf4a030404...b6.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bf4a030404a33a8c559e6247a6a7dde969beac784237a4bc09ee9782a6b13eb6

  • Size

    700KB

  • Sample

    241015-aq769axhnq

  • MD5

    22bb81fe492c73919a75ae4152bd6da9

  • SHA1

    93ea623df22f23cfba08fce532ae04b037f6f93f

  • SHA256

    bf4a030404a33a8c559e6247a6a7dde969beac784237a4bc09ee9782a6b13eb6

  • SHA512

    60cad20be3e4548eab668e1c1c280d9588241638f320e2d9f36587ea89754c47e47ac4ca692182b7707d326ee6c88229b350f39ef11cf1e9c2b1b2fbf2cc704c

  • SSDEEP

    12288:JqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:JqGBHTxvt+g2gYed

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      bf4a030404a33a8c559e6247a6a7dde969beac784237a4bc09ee9782a6b13eb6

    • Size

      700KB

    • MD5

      22bb81fe492c73919a75ae4152bd6da9

    • SHA1

      93ea623df22f23cfba08fce532ae04b037f6f93f

    • SHA256

      bf4a030404a33a8c559e6247a6a7dde969beac784237a4bc09ee9782a6b13eb6

    • SHA512

      60cad20be3e4548eab668e1c1c280d9588241638f320e2d9f36587ea89754c47e47ac4ca692182b7707d326ee6c88229b350f39ef11cf1e9c2b1b2fbf2cc704c

    • SSDEEP

      12288:JqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:JqGBHTxvt+g2gYed

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Dridex payload

      Detects Dridex x64 core DLL in memory.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks