Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    642bb1e7cedffeb47b39abdcc366b7a1136a2541bc47a9224283d458d30bc33f

  • Size

    353KB

  • Sample

    230412-23j4qsga27

  • MD5

    545e722f07e05fced4a4e8ebf8a61856

  • SHA1

    c06135d530e0d4164f2515c54c9559bd336a1d4d

  • SHA256

    642bb1e7cedffeb47b39abdcc366b7a1136a2541bc47a9224283d458d30bc33f

  • SHA512

    f3680e8f70d3f536205fd7974da542959fc0217daf762ee200105a6531b9c6527f4e556d86cb6210f2c13433f89d509b60347e0e6321b22f28a16688f940a2de

  • SSDEEP

    6144:vDThCX/lTlILJQq1F6TpfrFfDBtVyb+hrwTCV+E:vDcv/ILJt1FCp9tpwTCVr

Score
10/10
smokeloaderpub2backdoortrojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub2

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/
rc4.i32
rc4.i32

Targets

    • Target

      642bb1e7cedffeb47b39abdcc366b7a1136a2541bc47a9224283d458d30bc33f

    • Size

      353KB

    • MD5

      545e722f07e05fced4a4e8ebf8a61856

    • SHA1

      c06135d530e0d4164f2515c54c9559bd336a1d4d

    • SHA256

      642bb1e7cedffeb47b39abdcc366b7a1136a2541bc47a9224283d458d30bc33f

    • SHA512

      f3680e8f70d3f536205fd7974da542959fc0217daf762ee200105a6531b9c6527f4e556d86cb6210f2c13433f89d509b60347e0e6321b22f28a16688f940a2de

    • SSDEEP

      6144:vDThCX/lTlILJQq1F6TpfrFfDBtVyb+hrwTCV+E:vDcv/ILJt1FCp9tpwTCVr

    Score
    10/10
    smokeloaderpub2backdoortrojan

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks