Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    53290d7a62ef29e1448c29184065ed50df67f7be372753706e20409804e09450

  • Size

    261KB

  • Sample

    221231-rfhx2shf93

  • MD5

    01b3d33e9177f7a2f1af3dcd270a654d

  • SHA1

    318383633fa45e04700a17589ffde04cd5efcd9f

  • SHA256

    53290d7a62ef29e1448c29184065ed50df67f7be372753706e20409804e09450

  • SHA512

    fd38b87d00898680ee9ef08e2e3444bc9cb3d6a41d7a6b6c558df887adac66fb89e75859ff76501ecdfa0a5712d39b6aa67ab102f9e57697895dcdffb2a22184

  • SSDEEP

    3072:Hkcgt81YA4sHL/46TG14x1RQxHUsHLgug1zJVJ7ykkKVlmqEXz27hZY:HU6vBLgB1o09nsuuVVAaYiZY

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Targets

    • Target

      53290d7a62ef29e1448c29184065ed50df67f7be372753706e20409804e09450

    • Size

      261KB

    • MD5

      01b3d33e9177f7a2f1af3dcd270a654d

    • SHA1

      318383633fa45e04700a17589ffde04cd5efcd9f

    • SHA256

      53290d7a62ef29e1448c29184065ed50df67f7be372753706e20409804e09450

    • SHA512

      fd38b87d00898680ee9ef08e2e3444bc9cb3d6a41d7a6b6c558df887adac66fb89e75859ff76501ecdfa0a5712d39b6aa67ab102f9e57697895dcdffb2a22184

    • SSDEEP

      3072:Hkcgt81YA4sHL/46TG14x1RQxHUsHLgug1zJVJ7ykkKVlmqEXz27hZY:HU6vBLgB1o09nsuuVVAaYiZY

    Score
    10/10
    smokeloaderbackdoortrojan

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks