Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    57a0e2fcfe386ee249288200e072f2f809adcc2b475a6104feab914ccbb35bc4

  • Size

    1.0MB

  • Sample

    220308-vlxvyacchr

  • MD5

    778f174d7483a70a1a8e327ae3d4fcb8

  • SHA1

    39c283908dd2e16c0952d67ff1e42b003509214e

  • SHA256

    57a0e2fcfe386ee249288200e072f2f809adcc2b475a6104feab914ccbb35bc4

  • SHA512

    7034d577243a9242473597527e94df4ef950973bb795088bb16e73bf743a8423fc8579047f51c5f5c1c8bea3b36f070f053c19abde744bde0a9819a12dc6c017

Score
10/10
asyncratraccoonsmokeloader1c0fad6805a0f65d7b597130eb9f089ffbe9857dencoderbackdoorevasionratspywarestealersuricatatrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://2.56.59.26/

rc4.i32
rc4.i32

Extracted

Family

raccoon

Botnet

1c0fad6805a0f65d7b597130eb9f089ffbe9857d

Attributes
  • url4cnc

    http://194.180.191.241/capibar

    http://103.155.93.35/capibar

    https://t.me/capibar

rc4.plain
rc4.plain

Extracted

Family

asyncrat

Version

1.0.7

Botnet

encoder

C2

89.223.125.80:7655

Mutex

dev

Attributes
  • anti_vm

    true

  • bsod

    true

  • delay

    1

  • install

    false

  • install_file

    doncry.exe

  • install_folder

    %AppData%

  • pastebin_config

    null

aes.plain

Targets

    • Target

      57a0e2fcfe386ee249288200e072f2f809adcc2b475a6104feab914ccbb35bc4

    • Size

      1.0MB

    • MD5

      778f174d7483a70a1a8e327ae3d4fcb8

    • SHA1

      39c283908dd2e16c0952d67ff1e42b003509214e

    • SHA256

      57a0e2fcfe386ee249288200e072f2f809adcc2b475a6104feab914ccbb35bc4

    • SHA512

      7034d577243a9242473597527e94df4ef950973bb795088bb16e73bf743a8423fc8579047f51c5f5c1c8bea3b36f070f053c19abde744bde0a9819a12dc6c017

    Score
    10/10
    asyncratraccoonsmokeloader1c0fad6805a0f65d7b597130eb9f089ffbe9857dencoderbackdoorevasionratspywarestealersuricatatrojan

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

      suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

      suricata

    • suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)

      suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)

      suricata

    • Async RAT payload

      rat

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks whether UAC is enabled

      evasiontrojan

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

3
T1497

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

6
T1012

Virtualization/Sandbox Evasion

3
T1497

System Information Discovery

4
T1082

Peripheral Device Discovery

2
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks