Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9f4fd68b834ccb2547aa0374eaa03ed58624d44ac713aa38b0fad4adeca78320

  • Size

    292KB

  • Sample

    211015-scnvkabgem

  • MD5

    1e967a50090ea8bf8f02c1e4171ba2a5

  • SHA1

    93fc0c59a363d1a08bcbb28bf358a645ead22aca

  • SHA256

    9f4fd68b834ccb2547aa0374eaa03ed58624d44ac713aa38b0fad4adeca78320

  • SHA512

    1bf90cd884448a59e8b95ab2bd94cc184766d593579769f370c1944b2cee0805f395f991b2c76ffc8addf3c464b35a5e2ff7e80388fae2bb4eaf6d66cda7a3d4

Score
10/10
raccoonredlinesmokeloadervidar01971c26c29bbf6e54f3c895cd6c6ab13f72303f3dde9cf1ea25ec8623cf240fe8d23e8d3fe465f07ebf9b416b72a203df65383eec899dc689d2c3d7office365log and wallet zdycashbackdoorcollectiondiscoveryevasioninfostealerspywarestealersuricatathemidatrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://honawey7.top/

http://wijibui0.top/

http://hefahei6.top/

http://pipevai4.top/

http://nalirou7.top/

http://gfdjgdfjgdhfbg.space/

http://gfhjdsghdfjg23.space/

http://gdfjgdfh4543nf.space/

http://fgdjgsdfghj4fds.space/

http://fgdgdjfgfdgdf.space/

http://fsdhjfsdhfsd.space/

http://fgdsjghdfghjdfhgd.space/

http://ryuesrseyth3.space/

http://fdsjkuhreyu4.space/

http://fdgjdfgehr4.space/

http://fgdgjhdfgdfjgd.space/
rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

raccoon

Botnet

01971c26c29bbf6e54f3c895cd6c6ab13f72303f

Attributes
  • url4cnc

    http://telegatt.top/vvhotsummer

    http://telegka.top/vvhotsummer

    http://telegin.top/vvhotsummer

    https://t.me/vvhotsummer

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

7ebf9b416b72a203df65383eec899dc689d2c3d7

Attributes
  • url4cnc

    http://telegatt.top/agrybirdsgamerept

    http://telegka.top/agrybirdsgamerept

    http://telegin.top/agrybirdsgamerept

    https://t.me/agrybirdsgamerept

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

ZDYCASH

C2

45.67.231.145:10991

Extracted

Family

raccoon

Botnet

3dde9cf1ea25ec8623cf240fe8d23e8d3fe465f0

Attributes
  • url4cnc

    http://telegatt.top/d1rolsavage

    http://telegka.top/d1rolsavage

    http://telegin.top/d1rolsavage

    https://t.me/d1rolsavage

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

office365log and wallet

C2

185.215.113.102:10007

Targets

    • Target

      9f4fd68b834ccb2547aa0374eaa03ed58624d44ac713aa38b0fad4adeca78320

    • Size

      292KB

    • MD5

      1e967a50090ea8bf8f02c1e4171ba2a5

    • SHA1

      93fc0c59a363d1a08bcbb28bf358a645ead22aca

    • SHA256

      9f4fd68b834ccb2547aa0374eaa03ed58624d44ac713aa38b0fad4adeca78320

    • SHA512

      1bf90cd884448a59e8b95ab2bd94cc184766d593579769f370c1944b2cee0805f395f991b2c76ffc8addf3c464b35a5e2ff7e80388fae2bb4eaf6d66cda7a3d4

    Score
    10/10
    raccoonredlinesmokeloadervidar01971c26c29bbf6e54f3c895cd6c6ab13f72303f3dde9cf1ea25ec8623cf240fe8d23e8d3fe465f07ebf9b416b72a203df65383eec899dc689d2c3d7office365log and wallet zdycashbackdoorcollectiondiscoveryevasioninfostealerspywarestealersuricatathemidatrojan

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

      suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

      suricata

    • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

      suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

      suricata

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

6
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

6
T1082

Peripheral Device Discovery

2
T1120

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks