Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e029d2ad70976996f3b06e68e975b9db5a4ad4ea59adb51b1a7ca61c3858ece2

  • Size

    222KB

  • Sample

    221225-agajmaah26

  • MD5

    b9cfd872c8cdaafe3986e89c415578ef

  • SHA1

    c1c7f2ac843e6e4e3229af7574b3939128a701d5

  • SHA256

    e029d2ad70976996f3b06e68e975b9db5a4ad4ea59adb51b1a7ca61c3858ece2

  • SHA512

    4be0fd5e3774e537f7d7e5e99e8914b7ee7759ef20aa316eaf21ffdb0d55779ca700a914c3ceec16fd46c4184f321c566b41f0a150f252a94ca1660245d442a1

  • SSDEEP

    3072:pWpQwLJ2UTI53CV/fRGyLm5DF1E+hauDpNThf/ln:gpLJNTLfQy0haMjT

Score
10/10
smokeloaderbackdoorcollectiondiscoveryspywarestealertrojan

Malware Config

Targets

    • Target

      e029d2ad70976996f3b06e68e975b9db5a4ad4ea59adb51b1a7ca61c3858ece2

    • Size

      222KB

    • MD5

      b9cfd872c8cdaafe3986e89c415578ef

    • SHA1

      c1c7f2ac843e6e4e3229af7574b3939128a701d5

    • SHA256

      e029d2ad70976996f3b06e68e975b9db5a4ad4ea59adb51b1a7ca61c3858ece2

    • SHA512

      4be0fd5e3774e537f7d7e5e99e8914b7ee7759ef20aa316eaf21ffdb0d55779ca700a914c3ceec16fd46c4184f321c566b41f0a150f252a94ca1660245d442a1

    • SSDEEP

      3072:pWpQwLJ2UTI53CV/fRGyLm5DF1E+hauDpNThf/ln:gpLJNTLfQy0haMjT

    Score
    10/10
    smokeloaderbackdoorcollectiondiscoveryspywarestealertrojan

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks