Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0cea4c6e5eeb868bec2cb1f3a7e6e3fd91b10c44c948b776e5222bcc2c6ccdc6

  • Size

    1.8MB

  • Sample

    211227-2e9pgsbgbr

  • MD5

    bcb7ed6ce8049c39fcb79d49736fac30

  • SHA1

    f2245a6fd91aad6b94f7fed749c7c7721417eced

  • SHA256

    0cea4c6e5eeb868bec2cb1f3a7e6e3fd91b10c44c948b776e5222bcc2c6ccdc6

  • SHA512

    0d0f06ff1ddebe6410b24c94619c64985cc601fc276d2a69c380041680258530cb7ecf140260879b74ef3c12da16ac0de8dd5df69b148aaefa0c3792280679a1

Score
10/10
danabot4bankertrojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.244.223:443

192.236.194.72:443
Attributes
  • embedded_hash

    0FA95F120D6EB149A5D48E36BC76879D

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      0cea4c6e5eeb868bec2cb1f3a7e6e3fd91b10c44c948b776e5222bcc2c6ccdc6

    • Size

      1.8MB

    • MD5

      bcb7ed6ce8049c39fcb79d49736fac30

    • SHA1

      f2245a6fd91aad6b94f7fed749c7c7721417eced

    • SHA256

      0cea4c6e5eeb868bec2cb1f3a7e6e3fd91b10c44c948b776e5222bcc2c6ccdc6

    • SHA512

      0d0f06ff1ddebe6410b24c94619c64985cc601fc276d2a69c380041680258530cb7ecf140260879b74ef3c12da16ac0de8dd5df69b148aaefa0c3792280679a1

    Score
    10/10
    danabot4bankertrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot Loader Component

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Loads dropped DLL

    behavioral1

MITRE ATT&CK Matrix

Tasks