Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    624a20698d87689fae6d81db2d3bce7932e6ef3e65aabbd7d98ff97e4f7ee70d

  • Size

    256KB

  • Sample

    220916-ffzd9aadfj

  • MD5

    fd51cd7518ae01e52802694c6e8f5db9

  • SHA1

    35008bd25ff1c9f6d433e931ebfb19cf55d2efd4

  • SHA256

    624a20698d87689fae6d81db2d3bce7932e6ef3e65aabbd7d98ff97e4f7ee70d

  • SHA512

    5ca39d6ad720f2967bf8c893812a65dcdb46f5d7b4dd6cb6074944cd5e3f2a783e35a0558e776536cd750b59f00f11d69607abf0bb22a730c6e865bb325c59db

  • SSDEEP

    3072:LXMxCSz2xOeoTLS5E6UJmPeVbUPbvQkjTXMi0KuoITFPiM/h3BsxkgaBChULu:jWKRoTzJkwUTvDjTXMi027niga

Score
10/10
netsupportsmokeloaderbackdoorratspywarestealertrojanupx

Malware Config

Targets

    • Target

      624a20698d87689fae6d81db2d3bce7932e6ef3e65aabbd7d98ff97e4f7ee70d

    • Size

      256KB

    • MD5

      fd51cd7518ae01e52802694c6e8f5db9

    • SHA1

      35008bd25ff1c9f6d433e931ebfb19cf55d2efd4

    • SHA256

      624a20698d87689fae6d81db2d3bce7932e6ef3e65aabbd7d98ff97e4f7ee70d

    • SHA512

      5ca39d6ad720f2967bf8c893812a65dcdb46f5d7b4dd6cb6074944cd5e3f2a783e35a0558e776536cd750b59f00f11d69607abf0bb22a730c6e865bb325c59db

    • SSDEEP

      3072:LXMxCSz2xOeoTLS5E6UJmPeVbUPbvQkjTXMi0KuoITFPiM/h3BsxkgaBChULu:jWKRoTzJkwUTvDjTXMi027niga

    Score
    10/10
    netsupportsmokeloaderbackdoorratspywarestealertrojanupx

    • Detects Smokeloader packer

    • NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Deletes itself

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks