Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ac7da3fcbb8606947fe8a2482c4b8258d187b8f50a1ad98b8f4f64b4d409c80c

  • Size

    2.5MB

  • Sample

    221209-aa691sbh65

  • MD5

    4b76c1f757fbd9ce87c7dda793822ccc

  • SHA1

    6b3f52b923ef89433922e00015b57f207d35650e

  • SHA256

    ac7da3fcbb8606947fe8a2482c4b8258d187b8f50a1ad98b8f4f64b4d409c80c

  • SHA512

    c9dc6da9e9b2f723a433b85704ccaaff50e93b6044505c3413d35b18ce92eb22ad8926484fd9bdd3b52eda941e06963e7becd698019f0ec0fd54e379d19ceac9

  • SSDEEP

    49152:B7BLMEtsYQDpVpTCAMkGgFwfQ/gYf1gO89nSejrOH:NBLMEOpVmAD9ufQ/gM15Mnjfs

Score
10/10
danabotbankertrojan

Malware Config

Extracted

Family

danabot

Attributes
  • embedded_hash

    341D2FD1638BB267A80C7445E1909B57

  • type

    loader

Targets

    • Target

      ac7da3fcbb8606947fe8a2482c4b8258d187b8f50a1ad98b8f4f64b4d409c80c

    • Size

      2.5MB

    • MD5

      4b76c1f757fbd9ce87c7dda793822ccc

    • SHA1

      6b3f52b923ef89433922e00015b57f207d35650e

    • SHA256

      ac7da3fcbb8606947fe8a2482c4b8258d187b8f50a1ad98b8f4f64b4d409c80c

    • SHA512

      c9dc6da9e9b2f723a433b85704ccaaff50e93b6044505c3413d35b18ce92eb22ad8926484fd9bdd3b52eda941e06963e7becd698019f0ec0fd54e379d19ceac9

    • SSDEEP

      49152:B7BLMEtsYQDpVpTCAMkGgFwfQ/gYf1gO89nSejrOH:NBLMEOpVmAD9ufQ/gM15Mnjfs

    Score
    10/10
    danabotbankertrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks