EntropyMalware
Entropy is a ransomware first seen in 1st quarter of 2022, is being used in conjunction of Dridex infection. The ransomware uses a custom packer to pack itself which has been seen in some early dridex samples.From MISP Galaxy
Last reported 3 days ago, by Elastic Security Labs6 reports
ATT&CK techniques
6 of 35 · each with the sentence it comes from- T1027Obfuscated Files or Information
“T1027 Obfuscated Files or Information”
- T1041Exfiltration Over C2 Channel
“T1041 Exfiltration Over C2 Channel”
- T1055Process Injection
“Detecting Code Execution in Abnormal Memory Locations (MITRE ATT&CK T1055): Detections can flag execution attempts taking place outside the standard executable section, particularly when code executes directly within Process Environment Block (PEB) parameter buffers.”
- T1059Command and Scripting Interpreter
“…tivity maps to Exploit Public-Facing Application (T1190), and once an attacker has code execution, to Command and Scripting Interpreter (T1059) and Server Software Component: Web Shell (T1505.003).”
- T1119Automated Collection
“T1119 Automated Collection”
- T1614System Location Discovery
“T1614 System Location Discovery”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
6 reports, newest first · the exact sentence from each-
php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619“File with High Entropy Created by Web Server keys on a web server writing a high-entropy file with a web-executable extension, a common sign of an encoded or encrypted payload such as an obfuscated .phtml webshell.”
-
Process Parameter Poisoning: Inside a Novel EDR Evasion Technique“Analyzing Parameter Entropy and Argument Spoofing (MITRE ATT&CK T1564.010): Security tools can inspect initialization strings within process structures for unusually high entropy, which often indicates the presence of obfuscated or raw binary shellcode embedded within parameters.”
-
Smish. Click. Drained: Inside the Smishing Triad’s Phishing Cockpit“Entropy is uniformly high across the whole file.”
-
They Got In Through SonicWall. Then They Tried to Kill“Figure 6: Entropy of the svchost.exe binary (Source: DiE)”
-
CUBA Ransomware Malware Analysis“| Name | VirtualAddress | Virtual Size | Raw Size | Entropy | MD5 |”
-
BUGHATCH Malware Analysis“| Name | VirtualAddress | Virtual Size | Raw Size | Entropy | MD5 |”
Indicators in its reports
named in the reports above- obfuscator[.]ioin 1 report
- httpbin[.]orgin 1 report
- window[.]topin 1 report
- 193.160.216[.]221in 1 report
- 69.10.60[.]250in 1 report
- oemhwupd[.]syin 1 report
- 3111f4d7d4fac551…df97137fbee0in 1 report
- 6a6aaeed4a6bbe82…f45d5fb60939in 1 report
- 0f385cc69a93abea…805bdfe468a3in 1 report
- 3654af86dc682e95…b24bf2de879fin 1 report
- ca5f4af10abc885182f3fb9ed425de65in 1 report
- 931b22064e9e214bf59a4e07a6ca9109in 1 report
- f6f97411bcd64126a96b08ba9ae1e775in 1 report
- 03b1b11b4531bb656e43a8b457d4a5f7in 1 report
Copy these 14 indicators · defanged
Thanks — we review every report.