Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    42ddc5b2e93543928c77a7f1b2a4f7187c6e8b58cbc6f57c2c9292b567902110

  • Size

    213KB

  • Sample

    230106-abp25ahc7s

  • MD5

    282807a65ac21c4d8a5540f73f1c0e0e

  • SHA1

    a58515295181206356403aa9cf772b421264c089

  • SHA256

    42ddc5b2e93543928c77a7f1b2a4f7187c6e8b58cbc6f57c2c9292b567902110

  • SHA512

    238a0e8f743cdc0590d3756aab5bfe67a0d2c872eb65e9448a3e87665e74317122764f2b5ebf0c6311797071e5d6b630c5c7a91ccb0786fa50c419b0fa27bc40

  • SSDEEP

    3072:W9XhS7cbjL2kVfQjzBt355q0/52Um9dZBQ1u6pGfpW:W5J/L2kmjzBt3GO2Ts1u

Score
10/10
smokeloaderbackdoorcollectiondiscoveryspywarestealertrojan

Malware Config

Targets

    • Target

      42ddc5b2e93543928c77a7f1b2a4f7187c6e8b58cbc6f57c2c9292b567902110

    • Size

      213KB

    • MD5

      282807a65ac21c4d8a5540f73f1c0e0e

    • SHA1

      a58515295181206356403aa9cf772b421264c089

    • SHA256

      42ddc5b2e93543928c77a7f1b2a4f7187c6e8b58cbc6f57c2c9292b567902110

    • SHA512

      238a0e8f743cdc0590d3756aab5bfe67a0d2c872eb65e9448a3e87665e74317122764f2b5ebf0c6311797071e5d6b630c5c7a91ccb0786fa50c419b0fa27bc40

    • SSDEEP

      3072:W9XhS7cbjL2kVfQjzBt355q0/52Um9dZBQ1u6pGfpW:W5J/L2kmjzBt3GO2Ts1u

    Score
    10/10
    smokeloaderbackdoorcollectiondiscoveryspywarestealertrojan

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks