drokbk | 64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b | Triage

Submit
Reports

Overview

overview

Static

static

3

64f39b858c...1b.exe

windows7-x64

64f39b858c...1b.exe

windows10-2004-x64

Sharing

General

Target

64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b
Size

313KB
Sample

240410-nndrhshc2t
MD5

e26a66bfe0da89405e25a66baad95b05
SHA1

4eb5c832ce940739d6c0eb1b4fc7a78def1dd15e
SHA256

64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b
SHA512

2b24ae439a012e0dd8c0cf2669909d9e4b3ffa937dd856dd149db72ca231d749d63e7e960d41e57649b72b17f35f8b030d34f12e33aef6d4451e000ea4a2eb78
SSDEEP

6144:DDKW1Lgbdl0TBBvjc/h6iNYKfER27VcHmb7epjV5khYVyewqF:Xh1Lk70Tnvjc5zfEcapjVBNF

Score

10^/10

drokbk backdoor dropper persistence

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe

Resource

win7-20240221-en

drokbk backdoor dropper persistence

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe

Resource

win10v2004-20240226-en

drokbk backdoor dropper persistence

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b
- Size
  
  313KB
- MD5
  
  e26a66bfe0da89405e25a66baad95b05
- SHA1
  
  4eb5c832ce940739d6c0eb1b4fc7a78def1dd15e
- SHA256
  
  64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b
- SHA512
  
  2b24ae439a012e0dd8c0cf2669909d9e4b3ffa937dd856dd149db72ca231d749d63e7e960d41e57649b72b17f35f8b030d34f12e33aef6d4451e000ea4a2eb78
- SSDEEP
  
  6144:DDKW1Lgbdl0TBBvjc/h6iNYKfER27VcHmb7epjV5khYVyewqF:Xh1Lk70Tnvjc5zfEcapjVBNF
Score

10^/10

drokbk backdoor dropper persistence
- Drokbk
  Drokbk is a custom .NET dropper and backdoor.
  dropper backdoor drokbk
- Drokbk payload
- Creates new service(s)
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

drokbkbackdoordropperpersistence

behavioral2

drokbkbackdoordropperpersistence

© 2018-2025

Terms | Privacy