General

  • Target

    JaffaCakes118_0d4df34ff9a4e28a62836d529bc98e6f

  • Size

    808KB

  • Sample

    250604-h1n55asvgx

  • MD5

    0d4df34ff9a4e28a62836d529bc98e6f

  • SHA1

    60900836b7c8ce01803c788b42013e2af52c830f

  • SHA256

    e31f0fcd48b54042aa690dbfe79b6068051f821fd2409a7eed53f8d5eaffddc8

  • SHA512

    7de0508f506419bd4efb9258181a3242e720306c4d3c8b754e3f36ef6fa79f293578ef80ac39d67a4e22fe58913c1832a2fd05c79f28b5c035d40dac9ebac097

  • SSDEEP

    12288:4dMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:SMIJxSDX3bqjhcfHk7MzH6z

Malware Config

Targets

    • Target

      JaffaCakes118_0d4df34ff9a4e28a62836d529bc98e6f

    • Size

      808KB

    • MD5

      0d4df34ff9a4e28a62836d529bc98e6f

    • SHA1

      60900836b7c8ce01803c788b42013e2af52c830f

    • SHA256

      e31f0fcd48b54042aa690dbfe79b6068051f821fd2409a7eed53f8d5eaffddc8

    • SHA512

      7de0508f506419bd4efb9258181a3242e720306c4d3c8b754e3f36ef6fa79f293578ef80ac39d67a4e22fe58913c1832a2fd05c79f28b5c035d40dac9ebac097

    • SSDEEP

      12288:4dMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:SMIJxSDX3bqjhcfHk7MzH6z

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex family

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

    • Dridex payload

      Detects Dridex x64 core DLL in memory.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v16

Tasks