Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8b80e2a54a7f368e8bd06e380bedb5d766a7c4cc91d615c7d038b9096493d42f

  • Size

    377KB

  • Sample

    221206-q82eesge2s

  • MD5

    9164b49d2618ef4ff5f53b1e6e6ff070

  • SHA1

    9a28c1555595277671e367f0bbe912f4fbd58cb2

  • SHA256

    8b80e2a54a7f368e8bd06e380bedb5d766a7c4cc91d615c7d038b9096493d42f

  • SHA512

    1d783e848b404e60b36fa89e5ded65564308ce08aa32a3876ee64b7131c0822edc388e857136937b8536442d54d707ebfd46c72d30cc71f3d63aef068319e6b2

  • SSDEEP

    6144:B9K50Z8vLhk9ejzZLm+cgD/sAHOyig/LvPMk:B9K50ZCi9enJm+cgTszyzj

Score
10/10
smokeloaderbackdoorcollectiondiscoveryspywarestealertrojan

Malware Config

Targets

    • Target

      8b80e2a54a7f368e8bd06e380bedb5d766a7c4cc91d615c7d038b9096493d42f

    • Size

      377KB

    • MD5

      9164b49d2618ef4ff5f53b1e6e6ff070

    • SHA1

      9a28c1555595277671e367f0bbe912f4fbd58cb2

    • SHA256

      8b80e2a54a7f368e8bd06e380bedb5d766a7c4cc91d615c7d038b9096493d42f

    • SHA512

      1d783e848b404e60b36fa89e5ded65564308ce08aa32a3876ee64b7131c0822edc388e857136937b8536442d54d707ebfd46c72d30cc71f3d63aef068319e6b2

    • SSDEEP

      6144:B9K50Z8vLhk9ejzZLm+cgD/sAHOyig/LvPMk:B9K50ZCi9enJm+cgTszyzj

    Score
    10/10
    smokeloaderbackdoorcollectiondiscoveryspywarestealertrojan

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks