Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5a241a01bd80e8a56835c76e69acc9f4865392be3057753bd0d245ac089cb874

  • Size

    292KB

  • Sample

    211015-p7e95aahg9

  • MD5

    f95af069743da34cdafe4f5e0e64d3aa

  • SHA1

    8c833c6e1250e8967724ef163d7385756d8e0a47

  • SHA256

    5a241a01bd80e8a56835c76e69acc9f4865392be3057753bd0d245ac089cb874

  • SHA512

    957ed25a327261f6c5a510c36e625f497f433dc8e6ef01ad05baeeae1fc6ebdc2421d356d8daa10f81bcf1c1ed6931a36b7110cbd078a708843dd85d46c37853

Score
10/10
raccoonredlinesmokeloadervidar01971c26c29bbf6e54f3c895cd6c6ab13f72303f3dde9cf1ea25ec8623cf240fe8d23e8d3fe465f07ebf9b416b72a203df65383eec899dc689d2c3d7office365log and wallet zdycashbackdoorcollectiondiscoveryevasioninfostealerspywarestealerthemidatrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://honawey7.top/

http://wijibui0.top/

http://hefahei6.top/

http://pipevai4.top/

http://nalirou7.top/

http://gfdjgdfjgdhfbg.space/

http://gfhjdsghdfjg23.space/

http://gdfjgdfh4543nf.space/

http://fgdjgsdfghj4fds.space/

http://fgdgdjfgfdgdf.space/

http://fsdhjfsdhfsd.space/

http://fgdsjghdfghjdfhgd.space/

http://ryuesrseyth3.space/

http://fdsjkuhreyu4.space/

http://fdgjdfgehr4.space/

http://fgdgjhdfgdfjgd.space/
rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

raccoon

Botnet

01971c26c29bbf6e54f3c895cd6c6ab13f72303f

Attributes
  • url4cnc

    http://telegatt.top/vvhotsummer

    http://telegka.top/vvhotsummer

    http://telegin.top/vvhotsummer

    https://t.me/vvhotsummer

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

7ebf9b416b72a203df65383eec899dc689d2c3d7

Attributes
  • url4cnc

    http://telegatt.top/agrybirdsgamerept

    http://telegka.top/agrybirdsgamerept

    http://telegin.top/agrybirdsgamerept

    https://t.me/agrybirdsgamerept

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

ZDYCASH

C2

45.67.231.145:10991

Extracted

Family

raccoon

Botnet

3dde9cf1ea25ec8623cf240fe8d23e8d3fe465f0

Attributes
  • url4cnc

    http://telegatt.top/d1rolsavage

    http://telegka.top/d1rolsavage

    http://telegin.top/d1rolsavage

    https://t.me/d1rolsavage

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

office365log and wallet

C2

185.215.113.102:10007

Targets

    • Target

      5a241a01bd80e8a56835c76e69acc9f4865392be3057753bd0d245ac089cb874

    • Size

      292KB

    • MD5

      f95af069743da34cdafe4f5e0e64d3aa

    • SHA1

      8c833c6e1250e8967724ef163d7385756d8e0a47

    • SHA256

      5a241a01bd80e8a56835c76e69acc9f4865392be3057753bd0d245ac089cb874

    • SHA512

      957ed25a327261f6c5a510c36e625f497f433dc8e6ef01ad05baeeae1fc6ebdc2421d356d8daa10f81bcf1c1ed6931a36b7110cbd078a708843dd85d46c37853

    Score
    10/10
    raccoonredlinesmokeloadervidar01971c26c29bbf6e54f3c895cd6c6ab13f72303f3dde9cf1ea25ec8623cf240fe8d23e8d3fe465f07ebf9b416b72a203df65383eec899dc689d2c3d7office365log and wallet zdycashbackdoorcollectiondiscoveryevasioninfostealerspywarestealerthemidatrojan

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

6
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

6
T1082

Peripheral Device Discovery

2
T1120

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks