Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ac0f63093501fdc89039356f97161f4dad58f6398350f9f64320d169c94338e5

  • Size

    205KB

  • Sample

    230216-b9pppaeh4z

  • MD5

    1b7febefdcd54645120623c4ce42a459

  • SHA1

    fd8d246609e05c95b48fd3050de7f1e0e84aea19

  • SHA256

    ac0f63093501fdc89039356f97161f4dad58f6398350f9f64320d169c94338e5

  • SHA512

    c134999371558246b1d64e49e2b4618cbab39f70e4359dbd79fd2ad76d7e60cd8cd4e3657e970f011f1a3337c0bbec375ca1312e44392ae044dc245715812ee0

  • SSDEEP

    3072:bYwx7qrhMfHSeoXeb7XT4wQY5BH/jWRtoQklZTBdxJCvysXaMxoXHrnpKQ:0O7E9ObzT5V5gRbklHd6ysXa5N

Score
10/10
smokeloaderbackdoorcollectiondiscoveryspywarestealertrojan

Malware Config

Targets

    • Target

      ac0f63093501fdc89039356f97161f4dad58f6398350f9f64320d169c94338e5

    • Size

      205KB

    • MD5

      1b7febefdcd54645120623c4ce42a459

    • SHA1

      fd8d246609e05c95b48fd3050de7f1e0e84aea19

    • SHA256

      ac0f63093501fdc89039356f97161f4dad58f6398350f9f64320d169c94338e5

    • SHA512

      c134999371558246b1d64e49e2b4618cbab39f70e4359dbd79fd2ad76d7e60cd8cd4e3657e970f011f1a3337c0bbec375ca1312e44392ae044dc245715812ee0

    • SSDEEP

      3072:bYwx7qrhMfHSeoXeb7XT4wQY5BH/jWRtoQklZTBdxJCvysXaMxoXHrnpKQ:0O7E9ObzT5V5gRbklHd6ysXa5N

    Score
    10/10
    smokeloaderbackdoorcollectiondiscoveryspywarestealertrojan

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks