Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ed2de427ec5bc56e3111babf81e0b4a40e4c864492b9d8103ee5f4dff068595a

  • Size

    323KB

  • Sample

    211111-tvpp9abfa3

  • MD5

    85922f9e817d0817cd49956657b6826e

  • SHA1

    38bb437aa7d4d4de294bae84295501bc76305ab4

  • SHA256

    ed2de427ec5bc56e3111babf81e0b4a40e4c864492b9d8103ee5f4dff068595a

  • SHA512

    5d912138f020b61e09e0f047c292746b71dd87d9efbf702db01f000b98be39861c39a74ebc975380588bd69e967948d7790a0c0fbda3f8242df2e213532bdbb7

Score
10/10
raccoonredlinesmokeloader2189c5f17d25883af847061b1a1ac5c6eaa798744557a7b982bafcd677193713fa5041fa32e7e61e50c313b36d3f8d7fbe6f877cfa147276293d39c67776667778dec62c1db2959619dca43e02fa46ad7bd606400superstarvanguardbackdoordiscoveryinfostealerspywarestealertrojanvmprotect

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://nalirou70.top/

http://xacokuo80.top/

http://nusurtal4f.net/

http://netomishnetojuk.net/

http://escalivrouter.net/

http://nick22doom4.net/

http://wrioshtivsio.su/

http://nusotiso4.su/

http://rickkhtovkka.biz/

http://palisotoliso.net/
rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

777666777

C2

93.115.20.139:28978

Extracted

Family

redline

Botnet

SuperStar

C2

185.215.113.29:36224

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

2189c5f17d25883af847061b1a1ac5c6eaa79874

Attributes
  • url4cnc

    http://91.219.236.162/roswestnewros

    http://185.163.47.176/roswestnewros

    http://193.38.54.238/roswestnewros

    http://74.119.192.122/roswestnewros

    http://91.219.236.240/roswestnewros

    https://t.me/roswestnewros

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

8dec62c1db2959619dca43e02fa46ad7bd606400

Attributes
  • url4cnc

    http://telegin.top/capibar

    http://ttmirror.top/capibar

    http://teletele.top/capibar

    http://telegalive.top/capibar

    http://toptelete.top/capibar

    http://telegraf.top/capibar

    https://t.me/capibar

rc4.plain
rc4.plain

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

4557a7b982bafcd677193713fa5041fa32e7e61e

Attributes
  • url4cnc

    http://91.219.236.162/agrybirdsgamerept

    http://185.163.47.176/agrybirdsgamerept

    http://193.38.54.238/agrybirdsgamerept

    http://74.119.192.122/agrybirdsgamerept

    http://91.219.236.240/agrybirdsgamerept

rc4.plain
rc4.plain

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

50c313b36d3f8d7fbe6f877cfa147276293d39c6

Attributes
  • url4cnc

    http://91.219.236.162/jdex020001112

    http://185.163.47.176/jdex020001112

    http://193.38.54.238/jdex020001112

    http://74.119.192.122/jdex020001112

    http://91.219.236.240/jdex020001112

    https://t.me/jdex020001112

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

vanguard

C2

86.107.197.248:56626

Targets

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks