Overview

overview

9

Static

static

1

dridex

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    fd5c987d68dde5a267481ef532859628b0eceddf4662f75893f8c93d75e655da

  • Size

    3.4MB

  • Sample

    230313-s1wkbaba43

  • MD5

    74b0bd22051549f65a3be6b1ed0a471d

  • SHA1

    41537a92d89dd671dd84502dbbde8dbd6d27a27c

  • SHA256

    fd5c987d68dde5a267481ef532859628b0eceddf4662f75893f8c93d75e655da

  • SHA512

    c6c2cf0d5b20f1a63f0d03d6b462a657ce77a11d3fc21db7889d2bd7d387fc520620a13290cdd488310f478b86b35561dc6d73adeadf0972610794d159130ca8

  • SSDEEP

    98304:MsaEU6/HWQ4noYOCtapQX9ejqcT3/SgYS:OEH/QotQGrT3j

Score
9/10
discoveryevasiontrojanupx

Malware Config

Targets

    • Target

      fd5c987d68dde5a267481ef532859628b0eceddf4662f75893f8c93d75e655da

    • Size

      3.4MB

    • MD5

      74b0bd22051549f65a3be6b1ed0a471d

    • SHA1

      41537a92d89dd671dd84502dbbde8dbd6d27a27c

    • SHA256

      fd5c987d68dde5a267481ef532859628b0eceddf4662f75893f8c93d75e655da

    • SHA512

      c6c2cf0d5b20f1a63f0d03d6b462a657ce77a11d3fc21db7889d2bd7d387fc520620a13290cdd488310f478b86b35561dc6d73adeadf0972610794d159130ca8

    • SSDEEP

      98304:MsaEU6/HWQ4noYOCtapQX9ejqcT3/SgYS:OEH/QotQGrT3j

    Score
    9/10
    discoveryevasiontrojanupx

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Modifies file permissions

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks