Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    a4ec22bcfe6b8aef8e52550999e2651c9d396604e9b966a3ab54832cb6e5d008

  • Size

    227KB

  • Sample

    230202-b3t1tsga41

  • MD5

    ff1eaf52cc5220bbc3f2155afab853ce

  • SHA1

    eaac3f018469268acfc86d8bd3161571cc275c1d

  • SHA256

    a4ec22bcfe6b8aef8e52550999e2651c9d396604e9b966a3ab54832cb6e5d008

  • SHA512

    2c9d3d5aa97f58348c02ddec931db2431630c01c26590eab190740cd6d43e3f712f2f482d6ec5a2308a7c96fc1d81c034ebdd8fa7db1271aab13a6442901c997

  • SSDEEP

    3072:rpRaay9OIlO9jLp7WKI5we0LxWmzMkJvmFS8bz:rpCwJLp7L/zvg

Score
10/10
smokeloaderbackdoorcollectiondiscoveryspywarestealertrojan

Malware Config

Targets

    • Target

      a4ec22bcfe6b8aef8e52550999e2651c9d396604e9b966a3ab54832cb6e5d008

    • Size

      227KB

    • MD5

      ff1eaf52cc5220bbc3f2155afab853ce

    • SHA1

      eaac3f018469268acfc86d8bd3161571cc275c1d

    • SHA256

      a4ec22bcfe6b8aef8e52550999e2651c9d396604e9b966a3ab54832cb6e5d008

    • SHA512

      2c9d3d5aa97f58348c02ddec931db2431630c01c26590eab190740cd6d43e3f712f2f482d6ec5a2308a7c96fc1d81c034ebdd8fa7db1271aab13a6442901c997

    • SSDEEP

      3072:rpRaay9OIlO9jLp7WKI5we0LxWmzMkJvmFS8bz:rpCwJLp7L/zvg

    Score
    10/10
    smokeloaderbackdoorcollectiondiscoveryspywarestealertrojan

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks