Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    438bed3e38945b789cdabbe291ab45e7564e5c66cfe450ddbf5620480d933e49

  • Size

    375KB

  • Sample

    220910-b7agzsdbej

  • MD5

    78ae8331cff9571efa14252f8046a677

  • SHA1

    c43bc4282cf33144542f695c4443ff351600e3db

  • SHA256

    438bed3e38945b789cdabbe291ab45e7564e5c66cfe450ddbf5620480d933e49

  • SHA512

    b9ba2bca2d17648f37d64679c97633de46b9bcd9610f358c23d296f4ac927e59bd3680601568fc4975200a707a1c0f7f92b59744bdf7c2c039e330e8aafb47f1

  • SSDEEP

    6144:xv5zQJVb5p72cHF1ybDFwekh212KhvwIb759QOaBjpaVRPu23E2rJmWjFc94:x4VOiF1WD7kE1dTYOi8V5u23zmWFy4

Score
10/10
gh0stratratupx

Malware Config

Targets

    • Target

      438bed3e38945b789cdabbe291ab45e7564e5c66cfe450ddbf5620480d933e49

    • Size

      375KB

    • MD5

      78ae8331cff9571efa14252f8046a677

    • SHA1

      c43bc4282cf33144542f695c4443ff351600e3db

    • SHA256

      438bed3e38945b789cdabbe291ab45e7564e5c66cfe450ddbf5620480d933e49

    • SHA512

      b9ba2bca2d17648f37d64679c97633de46b9bcd9610f358c23d296f4ac927e59bd3680601568fc4975200a707a1c0f7f92b59744bdf7c2c039e330e8aafb47f1

    • SSDEEP

      6144:xv5zQJVb5p72cHF1ybDFwekh212KhvwIb759QOaBjpaVRPu23E2rJmWjFc94:x4VOiF1WD7kE1dTYOi8V5u23zmWFy4

    Score
    10/10
    gh0stratratupx

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks