Overview

overview

10

Static

static

3

64aceb8bda...18.dll

windows7-x64

10

64aceb8bda...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    64aceb8bda31f573a45db0ea2c70c918_JaffaCakes118

  • Size

    872KB

  • Sample

    241020-3qd8dsyeqj

  • MD5

    64aceb8bda31f573a45db0ea2c70c918

  • SHA1

    448bbb8dfded2f51b6b098cb2d650c961d0275b8

  • SHA256

    00a4f5b50c281942629456327a8a4772f28e234abcb4dc6ecd755ff849714a93

  • SHA512

    201c607317f291c84f417ca9b3c9c371c85140283c9d9279b62a8c46682224411ac3d612eafd95b606564893bea354df6af0ec7e443ae300e5862b591605e19f

  • SSDEEP

    12288:SdMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:kMIJxSDX3bqjhcfHk7MzH6z

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      64aceb8bda31f573a45db0ea2c70c918_JaffaCakes118

    • Size

      872KB

    • MD5

      64aceb8bda31f573a45db0ea2c70c918

    • SHA1

      448bbb8dfded2f51b6b098cb2d650c961d0275b8

    • SHA256

      00a4f5b50c281942629456327a8a4772f28e234abcb4dc6ecd755ff849714a93

    • SHA512

      201c607317f291c84f417ca9b3c9c371c85140283c9d9279b62a8c46682224411ac3d612eafd95b606564893bea354df6af0ec7e443ae300e5862b591605e19f

    • SSDEEP

      12288:SdMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:kMIJxSDX3bqjhcfHk7MzH6z

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Dridex payload

      Detects Dridex x64 core DLL in memory.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks