Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    decaa53dfe4684d0d4aa1ebfcda3a589c5328056117f31d53cfb8998ca182148

  • Size

    195KB

  • Sample

    230215-np5lmabc9w

  • MD5

    5fb7c7cd72e34ddd1d3705ee5293c5d0

  • SHA1

    0c31ac2f62b347c386a23eebe45e43d761df8044

  • SHA256

    decaa53dfe4684d0d4aa1ebfcda3a589c5328056117f31d53cfb8998ca182148

  • SHA512

    138559d29fbc5f7227ad4262bc052c2f161f6b0c858418874313e22543e63597b602a26d644484a70cb2616745300f72977680b0629a7bd0a7e19250c515715a

  • SSDEEP

    3072:trH6my7CYONNSEhkQao85deBz/SihYCd+8SNv8kR52S2VEjV:tD6cYONNNSFo8yMCd/2v8kH2Sjj

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Targets

    • Target

      decaa53dfe4684d0d4aa1ebfcda3a589c5328056117f31d53cfb8998ca182148

    • Size

      195KB

    • MD5

      5fb7c7cd72e34ddd1d3705ee5293c5d0

    • SHA1

      0c31ac2f62b347c386a23eebe45e43d761df8044

    • SHA256

      decaa53dfe4684d0d4aa1ebfcda3a589c5328056117f31d53cfb8998ca182148

    • SHA512

      138559d29fbc5f7227ad4262bc052c2f161f6b0c858418874313e22543e63597b602a26d644484a70cb2616745300f72977680b0629a7bd0a7e19250c515715a

    • SSDEEP

      3072:trH6my7CYONNSEhkQao85deBz/SihYCd+8SNv8kR52S2VEjV:tD6cYONNNSFo8yMCd/2v8kH2Sjj

    Score
    10/10
    smokeloaderbackdoortrojan

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks