Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5f72e854e154569525bcc47804262c7cebcff55c3418dab4d6bd72079491c8c1

  • Size

    1.9MB

  • Sample

    211230-qgdt2sfhe2

  • MD5

    d1120324f9eced8489f852383f2780ae

  • SHA1

    601b5cad71633c93f62a403bac4dac7997683cef

  • SHA256

    5f72e854e154569525bcc47804262c7cebcff55c3418dab4d6bd72079491c8c1

  • SHA512

    ba05a39f14ae896597ce36637264c7e875585a7e583a8cfc8605003c4d22b1ade650ca747cc72db5fe6810d88360055539f1f5ca43ac16b62c00ee5be929a0be

Score
10/10
danabot4bankertrojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.244.223:443

192.236.194.72:443
Attributes
  • embedded_hash

    0FA95F120D6EB149A5D48E36BC76879D

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      5f72e854e154569525bcc47804262c7cebcff55c3418dab4d6bd72079491c8c1

    • Size

      1.9MB

    • MD5

      d1120324f9eced8489f852383f2780ae

    • SHA1

      601b5cad71633c93f62a403bac4dac7997683cef

    • SHA256

      5f72e854e154569525bcc47804262c7cebcff55c3418dab4d6bd72079491c8c1

    • SHA512

      ba05a39f14ae896597ce36637264c7e875585a7e583a8cfc8605003c4d22b1ade650ca747cc72db5fe6810d88360055539f1f5ca43ac16b62c00ee5be929a0be

    Score
    10/10
    danabot4bankertrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Loads dropped DLL

    behavioral1

MITRE ATT&CK Matrix

Tasks