Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a40168b530d3ea4b9d3cef906d53d757755efee1572924d49a3eb968ccb37933

  • Size

    296KB

  • Sample

    221231-jwhm8ahd33

  • MD5

    9bb6008b648e3e1d6d1c76148217870c

  • SHA1

    7b74d75e415eb9f77ae22ee2261b5d54196c04e0

  • SHA256

    a40168b530d3ea4b9d3cef906d53d757755efee1572924d49a3eb968ccb37933

  • SHA512

    196fd0ae69b64767e871c516488705f45f4e06d709ac7597231497f57137ab7c06bc0bd7cd5a856bc5f311747d303701d54eaa7793ae57caa1348708d267a2aa

  • SSDEEP

    3072:8/ZW4if1/1pLeX1GoJoBRBOUiw6jbpJ1QOIxMGIXLqNwE6f+8U9SkEqwi:l4IrLyGoJoxahjbRQjiGIhE6G8UIkEq

Score
10/10
smokeloaderbackdoordiscoverytrojan

Malware Config

Targets

    • Target

      a40168b530d3ea4b9d3cef906d53d757755efee1572924d49a3eb968ccb37933

    • Size

      296KB

    • MD5

      9bb6008b648e3e1d6d1c76148217870c

    • SHA1

      7b74d75e415eb9f77ae22ee2261b5d54196c04e0

    • SHA256

      a40168b530d3ea4b9d3cef906d53d757755efee1572924d49a3eb968ccb37933

    • SHA512

      196fd0ae69b64767e871c516488705f45f4e06d709ac7597231497f57137ab7c06bc0bd7cd5a856bc5f311747d303701d54eaa7793ae57caa1348708d267a2aa

    • SSDEEP

      3072:8/ZW4if1/1pLeX1GoJoBRBOUiw6jbpJ1QOIxMGIXLqNwE6f+8U9SkEqwi:l4IrLyGoJoxahjbRQjiGIhE6G8UIkEq

    Score
    10/10
    smokeloaderbackdoordiscoverytrojan

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks