Overview

overview

10

Static

static

3

dridex

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ab1a7b4bd0fe528df9ed54e9a82c73d2ec3388b4f1cb8760d47da08ff1f4fc33

  • Size

    215KB

  • Sample

    230918-fdstpahe88

  • MD5

    f0254487ece298226fa2814a6b016aec

  • SHA1

    d3e4550f26ec77e29c388a755a464d3f6393c8b1

  • SHA256

    ab1a7b4bd0fe528df9ed54e9a82c73d2ec3388b4f1cb8760d47da08ff1f4fc33

  • SHA512

    aed432296630e321f3002542fe92a1da0dc167c36ed94014c4db2814033a7c41397e096a6308eb00e488641746b1c7223b8e54d4b7748b472e02cd813cfc1a89

  • SSDEEP

    6144:eABjsrLyz/NpQOSgy8NBC69wkGKKT25STf:eFGz/w/gySB5t3i

Score
10/10
smokeloaderup3backdoortrojan

Malware Config

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/
rc4.i32
rc4.i32

Targets

    • Target

      ab1a7b4bd0fe528df9ed54e9a82c73d2ec3388b4f1cb8760d47da08ff1f4fc33

    • Size

      215KB

    • MD5

      f0254487ece298226fa2814a6b016aec

    • SHA1

      d3e4550f26ec77e29c388a755a464d3f6393c8b1

    • SHA256

      ab1a7b4bd0fe528df9ed54e9a82c73d2ec3388b4f1cb8760d47da08ff1f4fc33

    • SHA512

      aed432296630e321f3002542fe92a1da0dc167c36ed94014c4db2814033a7c41397e096a6308eb00e488641746b1c7223b8e54d4b7748b472e02cd813cfc1a89

    • SSDEEP

      6144:eABjsrLyz/NpQOSgy8NBC69wkGKKT25STf:eFGz/w/gySB5t3i

    Score
    10/10
    smokeloaderup3backdoortrojan

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks