Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    fb26cb3f56d44181db0c5187a7d394a8b914995c8229752156097311cda65f85

  • Size

    282KB

  • Sample

    230113-jv136sbb5s

  • MD5

    a07f9504f0b1ed80fd33eb6d0fe3fb7c

  • SHA1

    4a40a8f29954d869a9ef96d7bf7f194e894d3a66

  • SHA256

    fb26cb3f56d44181db0c5187a7d394a8b914995c8229752156097311cda65f85

  • SHA512

    857d826c1617206da7515cd0ab9e7590c848ec99ebbb8ab33da341cb1924c96749911d1d1d41d248bbf0182e85e0e489e052fc057be91c07772a6108d91a73bc

  • SSDEEP

    6144:GFxLJHQ4D37DWZuqJABZH3vuZzxEmXCgyGoer:GFxNHQ47nWkIABVmZznS

Score
10/10
smokeloaderbackdoorcollectiondiscoveryspywarestealertrojan

Malware Config

Targets

    • Target

      fb26cb3f56d44181db0c5187a7d394a8b914995c8229752156097311cda65f85

    • Size

      282KB

    • MD5

      a07f9504f0b1ed80fd33eb6d0fe3fb7c

    • SHA1

      4a40a8f29954d869a9ef96d7bf7f194e894d3a66

    • SHA256

      fb26cb3f56d44181db0c5187a7d394a8b914995c8229752156097311cda65f85

    • SHA512

      857d826c1617206da7515cd0ab9e7590c848ec99ebbb8ab33da341cb1924c96749911d1d1d41d248bbf0182e85e0e489e052fc057be91c07772a6108d91a73bc

    • SSDEEP

      6144:GFxLJHQ4D37DWZuqJABZH3vuZzxEmXCgyGoer:GFxNHQ47nWkIABVmZznS

    Score
    10/10
    smokeloaderbackdoorcollectiondiscoveryspywarestealertrojan

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks