Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    90b8e3203a9bd4221ad483e4846ad0660da422a9c05a67cf30d589b5c661accb

  • Size

    240KB

  • Sample

    221212-txye6see9s

  • MD5

    e9ed7ac7b9ce65910af7bb1a7f284c25

  • SHA1

    72f26d8509a0d99790efb98d26abf39ca7664e93

  • SHA256

    90b8e3203a9bd4221ad483e4846ad0660da422a9c05a67cf30d589b5c661accb

  • SHA512

    2a1a409d2d5214580711f61f312412fea74bfafbef1359a3a70868c3f58b28d668585e776c340c65a3857c48ab827fd766014ed9b8d27293fd3b0ee7c55fbf01

  • SSDEEP

    3072:iSlBLeoPdkmXYvr5WFiuG3OfOuneBJFQrDN1ohdBcf0EFtDRbR8pgX:HLrkmXYYMuG3URS01oyftFxcpgX

Score
10/10
danabotsmokeloadersystembcbackdoorbankertrojan

Malware Config

Extracted

Family

systembc

C2

109.205.214.18:443

Targets

    • Target

      90b8e3203a9bd4221ad483e4846ad0660da422a9c05a67cf30d589b5c661accb

    • Size

      240KB

    • MD5

      e9ed7ac7b9ce65910af7bb1a7f284c25

    • SHA1

      72f26d8509a0d99790efb98d26abf39ca7664e93

    • SHA256

      90b8e3203a9bd4221ad483e4846ad0660da422a9c05a67cf30d589b5c661accb

    • SHA512

      2a1a409d2d5214580711f61f312412fea74bfafbef1359a3a70868c3f58b28d668585e776c340c65a3857c48ab827fd766014ed9b8d27293fd3b0ee7c55fbf01

    • SSDEEP

      3072:iSlBLeoPdkmXYvr5WFiuG3OfOuneBJFQrDN1ohdBcf0EFtDRbR8pgX:HLrkmXYYMuG3URS01oyftFxcpgX

    Score
    10/10
    danabotsmokeloadersystembcbackdoorbankertrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

      trojansystembc

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks