Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    826aa7cab1261071a7f0d65af41646414e0a3b5bf3fb556116e29f2c6f9077ef

  • Size

    223KB

  • Sample

    221228-t8qvgaah56

  • MD5

    bf60f62e4f36e7eed6655d1b6e2c5750

  • SHA1

    9379f3cc5248fbc21b33d268f8824aad65737545

  • SHA256

    826aa7cab1261071a7f0d65af41646414e0a3b5bf3fb556116e29f2c6f9077ef

  • SHA512

    4d83d0754b40e1a294968d53b631f545a101b97c91dfcdeefa1a9abd7d936738ac5b6205e15f470cc546cbb9fefb7cbeb695d7f8b38c64ba7064176bcb1690bd

  • SSDEEP

    3072:M4fLBkVyzUd5ETZz5NHBXuRgk+fDUuhxbn62snMgdx8KvIVbYwD3tdmdhEH:VLBZLduGPfnPKnxxxvIVsi3tm

Score
10/10
smokeloaderbackdoorcollectiondiscoveryspywarestealertrojan

Malware Config

Targets

    • Target

      826aa7cab1261071a7f0d65af41646414e0a3b5bf3fb556116e29f2c6f9077ef

    • Size

      223KB

    • MD5

      bf60f62e4f36e7eed6655d1b6e2c5750

    • SHA1

      9379f3cc5248fbc21b33d268f8824aad65737545

    • SHA256

      826aa7cab1261071a7f0d65af41646414e0a3b5bf3fb556116e29f2c6f9077ef

    • SHA512

      4d83d0754b40e1a294968d53b631f545a101b97c91dfcdeefa1a9abd7d936738ac5b6205e15f470cc546cbb9fefb7cbeb695d7f8b38c64ba7064176bcb1690bd

    • SSDEEP

      3072:M4fLBkVyzUd5ETZz5NHBXuRgk+fDUuhxbn62snMgdx8KvIVbYwD3tdmdhEH:VLBZLduGPfnPKnxxxvIVsi3tm

    Score
    10/10
    smokeloaderbackdoorcollectiondiscoveryspywarestealertrojan

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks