Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    22dc8c104a7b4f600e64f0aec457acc4cf83414f6dc508a1f53049a15f2c9847

  • Size

    2.5MB

  • Sample

    221209-eaay2acc46

  • MD5

    db5d7547831dfc443bcc953380afa8b4

  • SHA1

    0166d1c2b5a15abd94e8a7ec944d69a50f5b23c3

  • SHA256

    22dc8c104a7b4f600e64f0aec457acc4cf83414f6dc508a1f53049a15f2c9847

  • SHA512

    59a1a0700c07c210f68c48038aade61a33a04a1a89eb106c08e0fbc7df0fdeef631de38971bc043409ec5b7b99e6f29465f8301e23c1f87de6e8caf33aef5a7e

  • SSDEEP

    49152:PT147nphhsH/IK4Dw3smQz48WgRu0dJxDuX9+4W5NVnEIGl:L1KsH/jv01WgR1NuA550fl

Score
10/10
danabotbankertrojan

Malware Config

Extracted

Family

danabot

Attributes
  • embedded_hash

    341D2FD1638BB267A80C7445E1909B57

  • type

    loader

Targets

    • Target

      22dc8c104a7b4f600e64f0aec457acc4cf83414f6dc508a1f53049a15f2c9847

    • Size

      2.5MB

    • MD5

      db5d7547831dfc443bcc953380afa8b4

    • SHA1

      0166d1c2b5a15abd94e8a7ec944d69a50f5b23c3

    • SHA256

      22dc8c104a7b4f600e64f0aec457acc4cf83414f6dc508a1f53049a15f2c9847

    • SHA512

      59a1a0700c07c210f68c48038aade61a33a04a1a89eb106c08e0fbc7df0fdeef631de38971bc043409ec5b7b99e6f29465f8301e23c1f87de6e8caf33aef5a7e

    • SSDEEP

      49152:PT147nphhsH/IK4Dw3smQz48WgRu0dJxDuX9+4W5NVnEIGl:L1KsH/jv01WgR1NuA550fl

    Score
    10/10
    danabotbankertrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks