Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9f18b7105df6cd2c31995ba0eecdc9e8edec0aaafe70bc283eb98c32bce9d1cb

  • Size

    375KB

  • Sample

    221007-pk6hsscdf5

  • MD5

    aa901de8af4d8401092c3e8c9798fd0c

  • SHA1

    dbed6973dab8c994a83fcbb5e536b4363d5f5803

  • SHA256

    9f18b7105df6cd2c31995ba0eecdc9e8edec0aaafe70bc283eb98c32bce9d1cb

  • SHA512

    069c9b1242fd8468b379557f86e035c0d4c53f6f99762a0abeab8f73a0ea5f112ee76b1e02c380543ee4dac2771fc9251bdc150743e802578a2e95d9385c624a

  • SSDEEP

    6144:r4v5zQJVb5p72cHF1ybDFwekh212KhvwIb759QOaBjpaVRPu23E2rJmWjFc94:s4VOiF1WD7kE1dTYOi8V5u23zmWFy4

Score
10/10
gh0stratratupx

Malware Config

Targets

    • Target

      9f18b7105df6cd2c31995ba0eecdc9e8edec0aaafe70bc283eb98c32bce9d1cb

    • Size

      375KB

    • MD5

      aa901de8af4d8401092c3e8c9798fd0c

    • SHA1

      dbed6973dab8c994a83fcbb5e536b4363d5f5803

    • SHA256

      9f18b7105df6cd2c31995ba0eecdc9e8edec0aaafe70bc283eb98c32bce9d1cb

    • SHA512

      069c9b1242fd8468b379557f86e035c0d4c53f6f99762a0abeab8f73a0ea5f112ee76b1e02c380543ee4dac2771fc9251bdc150743e802578a2e95d9385c624a

    • SSDEEP

      6144:r4v5zQJVb5p72cHF1ybDFwekh212KhvwIb759QOaBjpaVRPu23E2rJmWjFc94:s4VOiF1WD7kE1dTYOi8V5u23zmWFy4

    Score
    10/10
    gh0stratratupx

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks