Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    778191a9fa130d85f1a312ca8780685f0e4773b104e806f7372c046d6bb67275

  • Size

    260KB

  • Sample

    230109-c3r2xacg53

  • MD5

    85acddc3bfa574f8fc7b4ce1985f29dc

  • SHA1

    cc1ea982f3534c94ae0a12a388f37e0e9cdd1ea7

  • SHA256

    778191a9fa130d85f1a312ca8780685f0e4773b104e806f7372c046d6bb67275

  • SHA512

    fba0fa63d1a61c5e933243a1780f3d492330b114d6ca813b524bcdf7b94a64571db15fae27f54f13992b2c5d1b7a338724e24a276e9c2d760f79566c0438bbb3

  • SSDEEP

    3072:9XERcDvL7hoV8tjsd5EB2ZENGMf0zBnM0bHH1QRomoA1ifQ19hZCRRzMuWZgd3n:5hLaV8tjsQ2ZiEzBb2oDfmcqgd3

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Targets

    • Target

      778191a9fa130d85f1a312ca8780685f0e4773b104e806f7372c046d6bb67275

    • Size

      260KB

    • MD5

      85acddc3bfa574f8fc7b4ce1985f29dc

    • SHA1

      cc1ea982f3534c94ae0a12a388f37e0e9cdd1ea7

    • SHA256

      778191a9fa130d85f1a312ca8780685f0e4773b104e806f7372c046d6bb67275

    • SHA512

      fba0fa63d1a61c5e933243a1780f3d492330b114d6ca813b524bcdf7b94a64571db15fae27f54f13992b2c5d1b7a338724e24a276e9c2d760f79566c0438bbb3

    • SSDEEP

      3072:9XERcDvL7hoV8tjsd5EB2ZENGMf0zBnM0bHH1QRomoA1ifQ19hZCRRzMuWZgd3n:5hLaV8tjsQ2ZiEzBb2oDfmcqgd3

    Score
    10/10
    smokeloaderbackdoortrojan

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks