Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    da0419198761d8b8ea3bf722ceef96cf3b27ffc4467a915c3ee3c58cdc809547

  • Size

    331KB

  • Sample

    221222-j8x9fahc8z

  • MD5

    3ef1b6606a77395968be5eee4a8b7d6e

  • SHA1

    89a1d29d6563a3df44c80106d9e4a2aad9819f12

  • SHA256

    da0419198761d8b8ea3bf722ceef96cf3b27ffc4467a915c3ee3c58cdc809547

  • SHA512

    5b1fd819831cfc3d756a346b5a345cadbe37400bd61449bab9399f835376fd546ebd6882ab97e610d239d000103225c302772b1120162ab8a2f287c90c113a5d

  • SSDEEP

    6144:xiX6LiIV2VboRHbL/5gU0WOnPAP9QwX61hJFIJfVAVrwU+:MqeI0bm7L/6Ul6AP9F6PHgtyQ

Score
10/10
smokeloaderbackdoorcollectiondiscoveryspywarestealertrojan

Malware Config

Targets

    • Target

      da0419198761d8b8ea3bf722ceef96cf3b27ffc4467a915c3ee3c58cdc809547

    • Size

      331KB

    • MD5

      3ef1b6606a77395968be5eee4a8b7d6e

    • SHA1

      89a1d29d6563a3df44c80106d9e4a2aad9819f12

    • SHA256

      da0419198761d8b8ea3bf722ceef96cf3b27ffc4467a915c3ee3c58cdc809547

    • SHA512

      5b1fd819831cfc3d756a346b5a345cadbe37400bd61449bab9399f835376fd546ebd6882ab97e610d239d000103225c302772b1120162ab8a2f287c90c113a5d

    • SSDEEP

      6144:xiX6LiIV2VboRHbL/5gU0WOnPAP9QwX61hJFIJfVAVrwU+:MqeI0bm7L/6Ul6AP9F6PHgtyQ

    Score
    10/10
    smokeloaderbackdoorcollectiondiscoveryspywarestealertrojan

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks