Overview

overview

10

Static

static

3

328aa9b106...5a.dll

windows7-x64

10

328aa9b106...5a.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    328aa9b1065fe77cc18f9c738b30eb12b1c1bb7c857fd91b075440d5e725885a

  • Size

    696KB

  • Sample

    241016-r1hg1svclg

  • MD5

    09eac984a186ff4bc57bbf0d7a04057b

  • SHA1

    fbef060f577b7aac6346db2072fc852aa4832b20

  • SHA256

    328aa9b1065fe77cc18f9c738b30eb12b1c1bb7c857fd91b075440d5e725885a

  • SHA512

    a690df7c00db4aa59b6a19995754820fc704a8f3524ce4394f8f99e2086b83ba835be63e490e63b59641c2e5ffd7cd575a4313021172351afe5d986a6a50980e

  • SSDEEP

    12288:RqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:RqGBHTxvt+g2gYed

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      328aa9b1065fe77cc18f9c738b30eb12b1c1bb7c857fd91b075440d5e725885a

    • Size

      696KB

    • MD5

      09eac984a186ff4bc57bbf0d7a04057b

    • SHA1

      fbef060f577b7aac6346db2072fc852aa4832b20

    • SHA256

      328aa9b1065fe77cc18f9c738b30eb12b1c1bb7c857fd91b075440d5e725885a

    • SHA512

      a690df7c00db4aa59b6a19995754820fc704a8f3524ce4394f8f99e2086b83ba835be63e490e63b59641c2e5ffd7cd575a4313021172351afe5d986a6a50980e

    • SSDEEP

      12288:RqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:RqGBHTxvt+g2gYed

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Dridex payload

      Detects Dridex x64 core DLL in memory.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks