Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0c234eb09ebee0e484dca3d0f6bf3072843b89527ecd6cfa4680eb27f0b8f032

  • Size

    213KB

  • Sample

    211026-npfbqshcd6

  • MD5

    f50e748b30a91dd671d0c6fc2f8e8681

  • SHA1

    67cee6fffd5e2ab09ed92f490b2f991902ce3c85

  • SHA256

    0c234eb09ebee0e484dca3d0f6bf3072843b89527ecd6cfa4680eb27f0b8f032

  • SHA512

    f081143710eef0ae705a7b145a46e0e08cbde32db587a8485b3867d0dcc17fb2378ee49ab35198072018a02ac384ce9b9532c2c944bbcbcbd38aae79a55f9f8a

Score
10/10
raccoonsmokeloader187e8d46623768b376fedb48580157fafedb4942backdoorstealertrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://brandyjaggers.com/upload/

http://andbal.com/upload/

http://alotofquotes.com/upload/

http://szpnc.cn/upload/

http://uggeboots.com/upload/

http://100klv.com/upload/

http://rapmusic.at/upload/
rc4.i32
rc4.i32

Extracted

Family

raccoon

Botnet

187e8d46623768b376fedb48580157fafedb4942

Attributes
  • url4cnc

    http://telegin.top/frombobu98s

    http://ttmirror.top/frombobu98s

    http://teletele.top/frombobu98s

    http://telegalive.top/frombobu98s

    http://toptelete.top/frombobu98s

    http://telegraf.top/frombobu98s

    https://t.me/frombobu98s

rc4.plain
rc4.plain

Targets

    • Target

      0c234eb09ebee0e484dca3d0f6bf3072843b89527ecd6cfa4680eb27f0b8f032

    • Size

      213KB

    • MD5

      f50e748b30a91dd671d0c6fc2f8e8681

    • SHA1

      67cee6fffd5e2ab09ed92f490b2f991902ce3c85

    • SHA256

      0c234eb09ebee0e484dca3d0f6bf3072843b89527ecd6cfa4680eb27f0b8f032

    • SHA512

      f081143710eef0ae705a7b145a46e0e08cbde32db587a8485b3867d0dcc17fb2378ee49ab35198072018a02ac384ce9b9532c2c944bbcbcbd38aae79a55f9f8a

    Score
    10/10
    raccoonsmokeloader187e8d46623768b376fedb48580157fafedb4942backdoorstealertrojan

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Deletes itself

    • Drops startup file

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks