Overview

overview

10

Static

static

3

384e3ceb6e...01.dll

windows7-x64

10

384e3ceb6e...01.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    384e3ceb6e99ca5fd18c7acad5e19854eb15dfeee39eddef8635d2b65be15901

  • Size

    684KB

  • Sample

    241021-zyr8fayekj

  • MD5

    25f805609c924aa76767968ad908ffcb

  • SHA1

    191c36a856126af5946e9de9cea3a7cca9d8a961

  • SHA256

    384e3ceb6e99ca5fd18c7acad5e19854eb15dfeee39eddef8635d2b65be15901

  • SHA512

    334526e7f8b539fc079c1a8fc2b75ad0639f9149eb55651cbda11a2f7be30f9f1de8fe7882aca33d5f906c3a38b8fb17b68ad3b5282c1fa4339fb0f97656328d

  • SSDEEP

    12288:/fndx6M581WsGRouyjzC6gn5l0H1Tak8jnGg/xeq7gz3xfsPEb4sk:3dAE81W381Wk8jnYz3dsPEb4s

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      384e3ceb6e99ca5fd18c7acad5e19854eb15dfeee39eddef8635d2b65be15901

    • Size

      684KB

    • MD5

      25f805609c924aa76767968ad908ffcb

    • SHA1

      191c36a856126af5946e9de9cea3a7cca9d8a961

    • SHA256

      384e3ceb6e99ca5fd18c7acad5e19854eb15dfeee39eddef8635d2b65be15901

    • SHA512

      334526e7f8b539fc079c1a8fc2b75ad0639f9149eb55651cbda11a2f7be30f9f1de8fe7882aca33d5f906c3a38b8fb17b68ad3b5282c1fa4339fb0f97656328d

    • SSDEEP

      12288:/fndx6M581WsGRouyjzC6gn5l0H1Tak8jnGg/xeq7gz3xfsPEb4sk:3dAE81W381Wk8jnYz3dsPEb4s

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Dridex payload

      Detects Dridex x64 core DLL in memory.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks