Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5eb32c3c418e66d52d67db15543dbef2a3527c770570a3516c0837f82af30306

  • Size

    6KB

  • Sample

    230201-qkm7wsfa26

  • MD5

    cd5dba86275cb98b648429bbfb50f1d9

  • SHA1

    5b99aa4e001a580ca8097ec321c63d340fadcaad

  • SHA256

    5eb32c3c418e66d52d67db15543dbef2a3527c770570a3516c0837f82af30306

  • SHA512

    f91182640397b076d66e45e30ac83f0f3ded6d418c1544fd78cca52218a5e7b36935e467b32a3ad0143d0f5fd1dc8185589b8c95f03067494f38df661404ee97

  • SSDEEP

    96:7Af4FhNIGruObywLtALd2JY1/1JxaPAk7G93ozNt:7Af4Fh2iuOXLFO/W7Wq

Score
10/10
purecrypterrhadamanthyscollectiondiscoverydownloaderloaderpersistencespywarestealer

Malware Config

Targets

    • Target

      5eb32c3c418e66d52d67db15543dbef2a3527c770570a3516c0837f82af30306

    • Size

      6KB

    • MD5

      cd5dba86275cb98b648429bbfb50f1d9

    • SHA1

      5b99aa4e001a580ca8097ec321c63d340fadcaad

    • SHA256

      5eb32c3c418e66d52d67db15543dbef2a3527c770570a3516c0837f82af30306

    • SHA512

      f91182640397b076d66e45e30ac83f0f3ded6d418c1544fd78cca52218a5e7b36935e467b32a3ad0143d0f5fd1dc8185589b8c95f03067494f38df661404ee97

    • SSDEEP

      96:7Af4FhNIGruObywLtALd2JY1/1JxaPAk7G93ozNt:7Af4Fh2iuOXLFO/W7Wq

    Score
    10/10
    purecrypterrhadamanthyscollectiondiscoverydownloaderloaderpersistencespywarestealer

    • Detect PureCrypter injector

      loader

    • Detect rhadamanthys stealer shellcode

    • PureCrypter

      PureCrypter is a .NET malware loader first seen in early 2021.

      loaderdownloaderpurecrypter

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks