Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c91c20fd0a9958c98beaa8b55958a10e29726e5b3a0a085f00911a833244bee1

  • Size

    317KB

  • Sample

    220125-lznpradff4

  • MD5

    fbae031469cbd507a050b883c31d00e9

  • SHA1

    3867f0fcffa7a8e26545155e2086b617276b9923

  • SHA256

    c91c20fd0a9958c98beaa8b55958a10e29726e5b3a0a085f00911a833244bee1

  • SHA512

    cae9878d39fdf7e2d16dab4884fcdbdf689b76f86e518c1587012820860471d179931ded9edec27b0102085cd77a3c85e22124464bbcaaa2ababc1644f6a38ca

Score
10/10
smokeloaderbackdoorcollectionevasiontrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://abpa.at/upload/

http://emaratghajari.com/upload/

http://d7qw.cn/upload/

http://alumik-group.ru/upload/

http://zamkikurgan.ru/upload/
rc4.i32
rc4.i32

Targets

    • Target

      c91c20fd0a9958c98beaa8b55958a10e29726e5b3a0a085f00911a833244bee1

    • Size

      317KB

    • MD5

      fbae031469cbd507a050b883c31d00e9

    • SHA1

      3867f0fcffa7a8e26545155e2086b617276b9923

    • SHA256

      c91c20fd0a9958c98beaa8b55958a10e29726e5b3a0a085f00911a833244bee1

    • SHA512

      cae9878d39fdf7e2d16dab4884fcdbdf689b76f86e518c1587012820860471d179931ded9edec27b0102085cd77a3c85e22124464bbcaaa2ababc1644f6a38ca

    Score
    10/10
    smokeloaderbackdoorcollectionevasiontrojan

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Deletes itself

    • Accesses Microsoft Outlook profiles

      collection
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks