Overview

overview

10

Static

static

7

dridex

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5c44891effd7c48cca89e73a7a6094a96caecd04185453e1693f5d9b29c8a709

  • Size

    8.4MB

  • Sample

    220216-sxtxbadbck

  • MD5

    4e53febf9950ac3cb71197a99fd88656

  • SHA1

    0b6eb96db5508c1c5c766b2d6fb0973a40193cb9

  • SHA256

    5c44891effd7c48cca89e73a7a6094a96caecd04185453e1693f5d9b29c8a709

  • SHA512

    ee85077c959556f4c9da0874891b7ea6573c176856fc6b966840383997485e9a99d5f04ccec23197ace35fbcab59548f57d9f0c9bb1f81bb94cc32423b9566c8

Score
10/10
xmrigevasionminerthemidatrojan

Malware Config

Targets

    • Target

      5c44891effd7c48cca89e73a7a6094a96caecd04185453e1693f5d9b29c8a709

    • Size

      8.4MB

    • MD5

      4e53febf9950ac3cb71197a99fd88656

    • SHA1

      0b6eb96db5508c1c5c766b2d6fb0973a40193cb9

    • SHA256

      5c44891effd7c48cca89e73a7a6094a96caecd04185453e1693f5d9b29c8a709

    • SHA512

      ee85077c959556f4c9da0874891b7ea6573c176856fc6b966840383997485e9a99d5f04ccec23197ace35fbcab59548f57d9f0c9bb1f81bb94cc32423b9566c8

    Score
    10/10
    xmrigevasionminerthemidatrojan

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • XMRig Miner Payload

      miner

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks