Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16077d98bce95514cd593cf1947d595c149908f61a0d80b4404d3596d6b56ade

  • Size

    292KB

  • Sample

    211015-rvpddabaf7

  • MD5

    51feb370526c461ce107673cc61fc5d4

  • SHA1

    fb2a9d5fc4e791d4b2819e3a553f3e402e8a05ea

  • SHA256

    16077d98bce95514cd593cf1947d595c149908f61a0d80b4404d3596d6b56ade

  • SHA512

    35b2a0dec411429ea75e841637b94599ca0f14c55f3969326dac652282a610f880ed9ef55f0112bbfbe0bc0b57533e21c442cb3cd2ebd066f35856cb64936fd0

Score
10/10
raccoonredlinesmokeloadervidar01971c26c29bbf6e54f3c895cd6c6ab13f72303f3dde9cf1ea25ec8623cf240fe8d23e8d3fe465f07ebf9b416b72a203df65383eec899dc689d2c3d7office365log and wallet zdycashbackdoorcollectiondiscoveryevasioninfostealerspywarestealerthemidatrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://honawey7.top/

http://wijibui0.top/

http://hefahei6.top/

http://pipevai4.top/

http://nalirou7.top/

http://gfdjgdfjgdhfbg.space/

http://gfhjdsghdfjg23.space/

http://gdfjgdfh4543nf.space/

http://fgdjgsdfghj4fds.space/

http://fgdgdjfgfdgdf.space/

http://fsdhjfsdhfsd.space/

http://fgdsjghdfghjdfhgd.space/

http://ryuesrseyth3.space/

http://fdsjkuhreyu4.space/

http://fdgjdfgehr4.space/

http://fgdgjhdfgdfjgd.space/
rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

raccoon

Botnet

01971c26c29bbf6e54f3c895cd6c6ab13f72303f

Attributes
  • url4cnc

    http://telegatt.top/vvhotsummer

    http://telegka.top/vvhotsummer

    http://telegin.top/vvhotsummer

    https://t.me/vvhotsummer

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

7ebf9b416b72a203df65383eec899dc689d2c3d7

Attributes
  • url4cnc

    http://telegatt.top/agrybirdsgamerept

    http://telegka.top/agrybirdsgamerept

    http://telegin.top/agrybirdsgamerept

    https://t.me/agrybirdsgamerept

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

ZDYCASH

C2

45.67.231.145:10991

Extracted

Family

raccoon

Botnet

3dde9cf1ea25ec8623cf240fe8d23e8d3fe465f0

Attributes
  • url4cnc

    http://telegatt.top/d1rolsavage

    http://telegka.top/d1rolsavage

    http://telegin.top/d1rolsavage

    https://t.me/d1rolsavage

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

office365log and wallet

C2

185.215.113.102:10007

Targets

    • Target

      16077d98bce95514cd593cf1947d595c149908f61a0d80b4404d3596d6b56ade

    • Size

      292KB

    • MD5

      51feb370526c461ce107673cc61fc5d4

    • SHA1

      fb2a9d5fc4e791d4b2819e3a553f3e402e8a05ea

    • SHA256

      16077d98bce95514cd593cf1947d595c149908f61a0d80b4404d3596d6b56ade

    • SHA512

      35b2a0dec411429ea75e841637b94599ca0f14c55f3969326dac652282a610f880ed9ef55f0112bbfbe0bc0b57533e21c442cb3cd2ebd066f35856cb64936fd0

    Score
    10/10
    raccoonredlinesmokeloadervidar01971c26c29bbf6e54f3c895cd6c6ab13f72303f3dde9cf1ea25ec8623cf240fe8d23e8d3fe465f07ebf9b416b72a203df65383eec899dc689d2c3d7office365log and wallet zdycashbackdoorcollectiondiscoveryevasioninfostealerspywarestealerthemidatrojan

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

6
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

6
T1082

Peripheral Device Discovery

2
T1120

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks