Overview

overview

10

Static

static

10

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    69a2806df93b940b5994427a85d50f9eb2094a2ff2f7563ec3d2da2894b05d00

  • Size

    14KB

  • Sample

    230318-j3qbmsdg3z

  • MD5

    20b40647e48a2d6e05bbc6b057abaeeb

  • SHA1

    99cbdc68e4410487021f871544cefe931ca811a9

  • SHA256

    69a2806df93b940b5994427a85d50f9eb2094a2ff2f7563ec3d2da2894b05d00

  • SHA512

    0225af49ac50708ff50411243c1ceab8d37107ba931d27235539e06d72b6f63fe8ec2440334b091d8e90dace1bc3c032f9654ec138032857fa7feae8092d2f2b

  • SSDEEP

    192:xGsuh2IoMFW2sa4rYSgL2Zvb2s/92+wtuTwbKhsR2b85iHtQmHPL:xGsdP6A5rY9L2Zvb2sl2+wwoXKQmHP

Score
10/10
purecrypterrhadamanthyscollectiondownloaderloaderstealer

Malware Config

Extracted

Family

purecrypter

C2

http://cleaning.homesecuritypc.com/packages/Yrirafgkx.png

http://cleaning.homesecuritypc.com/packages/Bhoewhjcalc.bmp

http://cleaning.homesecuritypc.com/packages/Qfold.png

http://cleaning.homesecuritypc.com/packages/Nkprcjqps.png

Targets

    • Target

      69a2806df93b940b5994427a85d50f9eb2094a2ff2f7563ec3d2da2894b05d00

    • Size

      14KB

    • MD5

      20b40647e48a2d6e05bbc6b057abaeeb

    • SHA1

      99cbdc68e4410487021f871544cefe931ca811a9

    • SHA256

      69a2806df93b940b5994427a85d50f9eb2094a2ff2f7563ec3d2da2894b05d00

    • SHA512

      0225af49ac50708ff50411243c1ceab8d37107ba931d27235539e06d72b6f63fe8ec2440334b091d8e90dace1bc3c032f9654ec138032857fa7feae8092d2f2b

    • SSDEEP

      192:xGsuh2IoMFW2sa4rYSgL2Zvb2s/92+wtuTwbKhsR2b85iHtQmHPL:xGsdP6A5rY9L2Zvb2sl2+wwoXKQmHP

    Score
    10/10
    purecrypterrhadamanthyscollectiondownloaderloaderstealer

    • Detect rhadamanthys stealer shellcode

    • PureCrypter

      PureCrypter is a .NET malware loader first seen in early 2021.

      loaderdownloaderpurecrypter

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Executes dropped EXE

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks