Overview

overview

10

Static

static

dridex

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    494b20591ce398e5421fba0bf1b4b6481f9d78061ce1e44ff0cb6e5dae7c237e

  • Size

    1.5MB

  • Sample

    220427-xfpcqadbgk

  • MD5

    7f839362f94f43a6b5bdde485470f4aa

  • SHA1

    bf9657ce81dbe25add5a8abcd5b5a7d4e8c58eef

  • SHA256

    494b20591ce398e5421fba0bf1b4b6481f9d78061ce1e44ff0cb6e5dae7c237e

  • SHA512

    e940dd1adcc4b7279098ae535b8fa3593130a0998797f5ccb9dcb4da5a22cbd0f7ef724f2fe53fd1828bb9993cd2389ecc7a53c80941465f88da51cf4fec3c61

Score
10/10
phoenixstealerevasionstealer

Malware Config

Targets

    • Target

      494b20591ce398e5421fba0bf1b4b6481f9d78061ce1e44ff0cb6e5dae7c237e

    • Size

      1.5MB

    • MD5

      7f839362f94f43a6b5bdde485470f4aa

    • SHA1

      bf9657ce81dbe25add5a8abcd5b5a7d4e8c58eef

    • SHA256

      494b20591ce398e5421fba0bf1b4b6481f9d78061ce1e44ff0cb6e5dae7c237e

    • SHA512

      e940dd1adcc4b7279098ae535b8fa3593130a0998797f5ccb9dcb4da5a22cbd0f7ef724f2fe53fd1828bb9993cd2389ecc7a53c80941465f88da51cf4fec3c61

    Score
    10/10
    phoenixstealerevasionstealer

    • PhoenixStealer

      PhoenixStealer is an information stealer written in the C++, it sends the stolen information to cybercriminals.

      stealerphoenixstealer

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks