Overview

overview

10

Static

static

3

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f7a735c08a0f4a9d1f736cedc05dcbd29cf349f68addc03060089b5d94f15e49

  • Size

    166KB

  • Sample

    231001-j5pswshf51

  • MD5

    b98d3407b2573b708945750ba53f790c

  • SHA1

    a30b32e4445cb2e74d71507047fdee9b0d2e0669

  • SHA256

    f7a735c08a0f4a9d1f736cedc05dcbd29cf349f68addc03060089b5d94f15e49

  • SHA512

    96e1244368987df883068c412ecbe45b4386c3b7a81057134da8892af73c8512b10be0df4e742f6ae22e15cdba2f1129af1f6e75913a98de7e6def0632582a92

  • SSDEEP

    3072:WhvUoaowo7h0BEYmbuw16GVuiIPMoCmTNxrm1CjkfRFyRvJ5Ofzj:WhcXiOBEBbx6GQP+CYfypqrj

Score
10/10
amadeyfabookiegluptebahealermysticredlinesmokeloader@ytlogsbotgruhaup3backdoordropperinfostealerloaderpersistencespywarestealertrojan

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

gruha

C2

77.91.124.55:19071

Attributes
  • auth_value

    2f4cf2e668a540e64775b27535cc6892

Extracted

Family

amadey

Version

3.89

C2

http://77.91.124.1/theme/index.php

Attributes
  • install_dir

    fefffe8cea

  • install_file

    explothe.exe

  • strings_key

    36a96139c1118a354edf72b1080d4b2f

rc4.plain

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

redline

Botnet

@ytlogsbot

C2

176.123.4.46:33783

Attributes
  • auth_value

    295b226f1b63bcd55148625381b27b19

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/
rc4.i32
rc4.i32

Extracted

Family

fabookie

C2

http://app.nnnaajjjgc.com/check/safe

Targets

    • Target

      f7a735c08a0f4a9d1f736cedc05dcbd29cf349f68addc03060089b5d94f15e49

    • Size

      166KB

    • MD5

      b98d3407b2573b708945750ba53f790c

    • SHA1

      a30b32e4445cb2e74d71507047fdee9b0d2e0669

    • SHA256

      f7a735c08a0f4a9d1f736cedc05dcbd29cf349f68addc03060089b5d94f15e49

    • SHA512

      96e1244368987df883068c412ecbe45b4386c3b7a81057134da8892af73c8512b10be0df4e742f6ae22e15cdba2f1129af1f6e75913a98de7e6def0632582a92

    • SSDEEP

      3072:WhvUoaowo7h0BEYmbuw16GVuiIPMoCmTNxrm1CjkfRFyRvJ5Ofzj:WhcXiOBEBbx6GQP+CYfypqrj

    Score
    10/10
    amadeyfabookiegluptebahealermysticredlinesmokeloader@ytlogsbotgruhaup3backdoordropperinfostealerloaderpersistencespywarestealertrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Detect Fabookie payload

    • Detects Healer an antivirus disabler dropper

    • Fabookie

      Fabookie is facebook account info stealer.

      spywarestealerfabookie

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Glupteba payload

    • Healer

      Healer an antivirus disabler dropper.

      dropperhealer

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks