dridex | 51cf44bbd50316dd6456f4df6c461733c09819ab884b20524a4e894ba5492342 | Triage

Submit
Reports

Overview

overview

Static

static

3

51cf44bbd5...42.dll

windows7-x64

51cf44bbd5...42.dll

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target

51cf44bbd50316dd6456f4df6c461733c09819ab884b20524a4e894ba5492342
Size

708KB
Sample

241022-agnfgsvdrd
MD5

19e0da0415c781dc9a288722bc701c09
SHA1

daf23af4714e913c83b3ac2ed9429c0db92ba8dc
SHA256

51cf44bbd50316dd6456f4df6c461733c09819ab884b20524a4e894ba5492342
SHA512

032e1980098d1de45353bf1831e90d6ab9ebef726b7b0fffadc368278115d025cbe98608c81cbb086df2e61b8bf253ba92996b8cf119bfdc2c5460d8bd4f6518
SSDEEP

12288:OEwgKnIhABTW0HcD5a1PKxdZhC+k+V9Hgeb/tf/B9P632vHAA:OEwXnOAx5HcDM1Sxd3ChCHg2/P9yGo

Score

10^/10

dridex botnet evasion payload persistence privilege_escalation trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

51cf44bbd50316dd6456f4df6c461733c09819ab884b20524a4e894ba5492342.dll

Resource

win7-20240903-en

dridex botnet evasion payload persistence trojan

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

51cf44bbd50316dd6456f4df6c461733c09819ab884b20524a4e894ba5492342.dll

Resource

win10v2004-20241007-en

dridex botnet evasion payload persistence privilege_escalation trojan

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  51cf44bbd50316dd6456f4df6c461733c09819ab884b20524a4e894ba5492342
- Size
  
  708KB
- MD5
  
  19e0da0415c781dc9a288722bc701c09
- SHA1
  
  daf23af4714e913c83b3ac2ed9429c0db92ba8dc
- SHA256
  
  51cf44bbd50316dd6456f4df6c461733c09819ab884b20524a4e894ba5492342
- SHA512
  
  032e1980098d1de45353bf1831e90d6ab9ebef726b7b0fffadc368278115d025cbe98608c81cbb086df2e61b8bf253ba92996b8cf119bfdc2c5460d8bd4f6518
- SSDEEP
  
  12288:OEwgKnIhABTW0HcD5a1PKxdZhC+k+V9Hgeb/tf/B9P632vHAA:OEwXnOAx5HcDM1Sxd3ChCHg2/P9yGo
Score

10^/10

dridex botnet evasion payload persistence trojan privilege_escalation
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Shellcode
  Detects Dridex Payload shellcode injected in Explorer process.
  botnet payload
- Dridex payload
  Detects Dridex x64 core DLL in memory.
  botnet payload
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Accessibility Features

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Accessibility Features

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dridexbotnetevasionpayloadpersistencetrojan

behavioral2

dridexbotnetevasionpayloadpersistenceprivilege_escalationtrojan

© 2018-2025

Terms | Privacy