Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    073e8e379cfda6d66a7bd7823a08a84fac7ca1aef34b2a962e2f60001ca8d1b9

  • Size

    284KB

  • Sample

    230113-qbj4waha88

  • MD5

    9a827b95feb18e878b09adb8d592c1be

  • SHA1

    62334ae86fb6ac4482f82e1ffc6b1835427c2ba4

  • SHA256

    073e8e379cfda6d66a7bd7823a08a84fac7ca1aef34b2a962e2f60001ca8d1b9

  • SHA512

    a250fed9e71f51be7711240a7a42333c86940ca1fa36771d930db3d76780989e0df3f5e60b15f103b5e8a003bf253b5d2dcd235355faa024cb942fa91c8add97

  • SSDEEP

    6144:E3+q7RLTyLkns8gIM72HcF9SlJZ9tzrSA3Wb:E3+q7R/yLN12HcUZ9P3Wb

Score
10/10
smokeloaderbackdoorcollectiondiscoveryspywarestealertrojan

Malware Config

Targets

    • Target

      073e8e379cfda6d66a7bd7823a08a84fac7ca1aef34b2a962e2f60001ca8d1b9

    • Size

      284KB

    • MD5

      9a827b95feb18e878b09adb8d592c1be

    • SHA1

      62334ae86fb6ac4482f82e1ffc6b1835427c2ba4

    • SHA256

      073e8e379cfda6d66a7bd7823a08a84fac7ca1aef34b2a962e2f60001ca8d1b9

    • SHA512

      a250fed9e71f51be7711240a7a42333c86940ca1fa36771d930db3d76780989e0df3f5e60b15f103b5e8a003bf253b5d2dcd235355faa024cb942fa91c8add97

    • SSDEEP

      6144:E3+q7RLTyLkns8gIM72HcF9SlJZ9tzrSA3Wb:E3+q7R/yLN12HcUZ9P3Wb

    Score
    10/10
    smokeloaderbackdoorcollectiondiscoveryspywarestealertrojan

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks