Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    66d324d43e5b70d2bfed9688b679a32d93486659758b699e2b520f0ecd613f00

  • Size

    198KB

  • Sample

    220924-vn1dvabfe9

  • MD5

    a2f48d20a213b968e82201ef20621f38

  • SHA1

    c7578d5922e1b91259191fd64bc20bb8c7f4efff

  • SHA256

    66d324d43e5b70d2bfed9688b679a32d93486659758b699e2b520f0ecd613f00

  • SHA512

    7c4eca440559be3fb48778b1ad9a22ab9cb78c4ac509d4b09e03bcff8fd695e2a01edfc1942a9637d10b26c5ede60327cee385a969f0af093ea9861d4ba23fcf

  • SSDEEP

    3072:IFE+wLFFcMhpA5NfI02eaFpk5pBgj0SwFR+4j4O8BgcR/Pkk4x:dLFphG2eaFpCpBgjLqRDXc

Score
10/10
danabotsmokeloaderbackdoorbankertrojan

Malware Config

Extracted

Family

danabot

C2

198.15.112.179:443

185.62.56.245:443

153.92.223.225:443

192.119.70.159:443
Attributes
  • embedded_hash

    6618C163D57D6441FCCA65D86C4D380D

  • type

    loader

Targets

    • Target

      66d324d43e5b70d2bfed9688b679a32d93486659758b699e2b520f0ecd613f00

    • Size

      198KB

    • MD5

      a2f48d20a213b968e82201ef20621f38

    • SHA1

      c7578d5922e1b91259191fd64bc20bb8c7f4efff

    • SHA256

      66d324d43e5b70d2bfed9688b679a32d93486659758b699e2b520f0ecd613f00

    • SHA512

      7c4eca440559be3fb48778b1ad9a22ab9cb78c4ac509d4b09e03bcff8fd695e2a01edfc1942a9637d10b26c5ede60327cee385a969f0af093ea9861d4ba23fcf

    • SSDEEP

      3072:IFE+wLFFcMhpA5NfI02eaFpk5pBgj0SwFR+4j4O8BgcR/Pkk4x:dLFphG2eaFpCpBgjLqRDXc

    Score
    10/10
    danabotsmokeloaderbackdoorbankertrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Deletes itself

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks