Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    557e5c189003c36d6bb1995566d58c18c5cebf66cca5c18a34126ba10f952750

  • Size

    202KB

  • Sample

    210906-tkqjssedgm

  • MD5

    87c2b5036459800af1f256dced921a89

  • SHA1

    8b464fd4dca7a5e3afe25281534eeb502a1c7968

  • SHA256

    557e5c189003c36d6bb1995566d58c18c5cebf66cca5c18a34126ba10f952750

  • SHA512

    16509d8b54e5261f8051db482b3d425d90f90071d34e87377d8fdbe943a3b746fd8573f538ade7c52b7e32ccf3bae26c459349a603a6ef0074d2ca1bf44b677d

Score
10/10
redlinesmokeloadervidar06.0910022937973binancenorman3testинсталлусыbackdoorevasioninfostealerstealersuricatathemidatrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://fazanaharahe1.xyz/

http://xandelissane2.xyz/

http://ustiassosale3.xyz/

http://cytheriata4.xyz/

http://ggiergionard5.xyz/

http://rrelleynaniy6.store/

http://danniemusoa7.store/

http://nastanizab8.store/

http://onyokandis9.store/

http://dmunaavank10.store/

http://gilmandros11.site/

http://cusanthana12.site/

http://willietjeana13.site/

http://ximusokall14.site/

http://blodinetisha15.site/

http://urydiahadyss16.club/

http://glasamaddama17.club/

http://marlingarly18.club/

http://alluvianna19.club/

http://xandirkaniel20.club/
rc4.i32
rc4.i32

Extracted

Family

vidar

Version

40.4

Botnet

1002

C2

https://romkaxarit.tumblr.com/

Attributes
  • profile_id

    1002

Extracted

Family

vidar

Version

40.4

Botnet

973

C2

https://romkaxarit.tumblr.com/

Attributes
  • profile_id

    973

Extracted

Family

redline

Botnet

binance

C2

212.86.102.139:32600

Extracted

Family

redline

Botnet

Инсталлусы

C2

91.142.77.155:5469

Extracted

Family

redline

Botnet

2

C2

45.147.228.207:1569

Extracted

Family

redline

Botnet

test

C2

45.14.49.169:22411

Extracted

Family

redline

Botnet

NORMAN3

C2

45.14.49.184:28743

Extracted

Family

redline

Botnet

06.09

C2

95.181.163.157:15089

Extracted

Family

vidar

Version

40.4

Botnet

937

C2

https://romkaxarit.tumblr.com/

Attributes
  • profile_id

    937

Targets

    • Target

      557e5c189003c36d6bb1995566d58c18c5cebf66cca5c18a34126ba10f952750

    • Size

      202KB

    • MD5

      87c2b5036459800af1f256dced921a89

    • SHA1

      8b464fd4dca7a5e3afe25281534eeb502a1c7968

    • SHA256

      557e5c189003c36d6bb1995566d58c18c5cebf66cca5c18a34126ba10f952750

    • SHA512

      16509d8b54e5261f8051db482b3d425d90f90071d34e87377d8fdbe943a3b746fd8573f538ade7c52b7e32ccf3bae26c459349a603a6ef0074d2ca1bf44b677d

    Score
    10/10
    redlinesmokeloadervidar06.0910022937973binancenorman3testинсталлусыbackdoorevasioninfostealerstealersuricatathemidatrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

      suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

      suricata

    • Vidar Stealer

      stealer

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Disabling Security Tools

1
T1089

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks