Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    edc29fe698230e37846eaa00d4aeed60550c09674bf628237c9b942e0085d121

  • Size

    4.3MB

  • Sample

    211028-gn4vdahch3

  • MD5

    239348d287c11a59a46078a95c0274ba

  • SHA1

    e27f3e5a2c8b629d799d3d04396fcec50c435e6f

  • SHA256

    edc29fe698230e37846eaa00d4aeed60550c09674bf628237c9b942e0085d121

  • SHA512

    69f0ef71d9d358ceb4a73345cefa48a8e388f6a9dd62aa82487fbe1983c8d372dd40407e756ac7245d45b85fdcc2c4b538b02d6a7b9cb3f874ea64cb0cbc0397

Score
10/10
servhelperxmrigbackdoorminerpersistencetrojan

Malware Config

Targets

    • Target

      edc29fe698230e37846eaa00d4aeed60550c09674bf628237c9b942e0085d121

    • Size

      4.3MB

    • MD5

      239348d287c11a59a46078a95c0274ba

    • SHA1

      e27f3e5a2c8b629d799d3d04396fcec50c435e6f

    • SHA256

      edc29fe698230e37846eaa00d4aeed60550c09674bf628237c9b942e0085d121

    • SHA512

      69f0ef71d9d358ceb4a73345cefa48a8e388f6a9dd62aa82487fbe1983c8d372dd40407e756ac7245d45b85fdcc2c4b538b02d6a7b9cb3f874ea64cb0cbc0397

    Score
    10/10
    servhelperxmrigbackdoorminerpersistencetrojan

    • ServHelper

      ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

      trojanbackdoorservhelper

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Modifies RDP port number used by Windows

    • Sets DLL path for service in the registry

      persistence

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks