teardrop | TEARDROP_infected[.]zip

General

Target
TEARDROP_infected.zip
Size 12.2MB
Sample260903-c19h6ssyay
SHA256 cf50e1d04848a4f4270b0e8e76922b4ffbd4435247e3741d1b197f5374d2f99c
MD5 0f98d0dd6dad2d521399de717678307a
SHA1 08b4f5bf88dbef589a676cbc40c4e2a3fe1daaff
SHA512 da394a98e0acdc0d63d1481b33c5ccfb293683189c3ca52b21c1bba06cd3550431c67100cdaa01a2a206da25dee0e6c51ba176fdc4194af47d91b8419c0f76dd
SSDEEP 393216:FHqOwlQkTvq2SIOW+EIWA7CX4VdgTe3b9:F0JTStA+Z/7CYdl
TLSH
T168D63321DD2C4F380F15AB0CE90AE8CA1B093A17749D2F35F31359763A5688FD71AE69
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

dropper backdoor trojan teardrop

Malware Config

Signatures

Family: Teardrop
Teardrop is a 64-bit DLL backdoor related to the SolarWinds breaches.
trojan backdoor teardrop

Detected TEARDROP fileless dropper 1 IoCs

TEARDROP is a memory-only dropper which can read files/registry keys, decode an embedded payload, and load it directly into memory.

dropper backdoor

resource	yara_rule
static1/unpack001/CPUIDHWMonitor.exe	family_teardrop

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/CPUIDHWMonitor.exe

File Explorer

TEARDROP_infected.zip

.zip 12.2MB
CPUIDHWMonitor.exe

.exe 18.8MB

TEARDROP_infected.zip

SHA256 cf50e1d04848a4f4270b0e8e76922b4ffbd4435247e3741d1b197f5374d2f99c
MD5 0f98d0dd6dad2d521399de717678307a
SHA1 08b4f5bf88dbef589a676cbc40c4e2a3fe1daaff
SHA512 da394a98e0acdc0d63d1481b33c5ccfb293683189c3ca52b21c1bba06cd3550431c67100cdaa01a2a206da25dee0e6c51ba176fdc4194af47d91b8419c0f76dd
SSDEEP 393216:FHqOwlQkTvq2SIOW+EIWA7CX4VdgTe3b9:F0JTStA+Z/7CYdl
TLSH
T168D63321DD2C4F380F15AB0CE90AE8CA1B093A17749D2F35F31359763A5688FD71AE69
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

CPUIDHWMonitor.exe

IMPHASH 1e01c3bca7bb8f8c6e7ba7542db483a9
SHA256 93c3fc2cf55dedbf9fe9325f7ed62aa39a289d5f83d6ddffdf282a1278b88c0d
MD5 c263a3a82e0ac4a0c38afa6def80669d
SHA1 7f46dd12ec28d245ba4fd578b84e71365077fcff
SHA512 338acbbb4996f14bb14b6a282018f8c6ac7e3e3fe804f7dc48456e6093f59677506a8133f14c20f9333254e9d7eef81b421f89512bb7a07f38f4aebbdfa36885
SSDEEP 393216:HevDtsswizD+ek5yd3ShUuLXSPKdMOd7JiWVKQ2v/1R0pUvt1QkZPk0H:ADOs5zDL/d3Xibd7c+bEzfFLH
TLSH
T11B17D0B8951E18C5FF61EDF985C5679C810D39723F283AA3B01EA300077247A5BE7D9A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detected TEARDROP fileless dropper

TEARDROP is a memory-only dropper which can read files/registry keys, decode an embedded payload, and load it directly into memory.

dropper backdoor
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

6

Entry point

19668601

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

8.5MB

Virtual Size

8.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

540B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

274KB

Virtual Size

274KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.0Dev

Size

8.7MB

Virtual Size

8.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

TEARDROP_infected.zip

CPUIDHWMonitor.exe

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

TEARDROP_infected.zip

CPUIDHWMonitor.exe

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

kernel32

generic