Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5c2f63b8821678ad4328e01f7b4512febdd8cff2ba762d6577744844514fbc3f

  • Size

    214KB

  • Sample

    221217-f98vsaba7w

  • MD5

    e05542960134ab0160c8c7f7a17aca89

  • SHA1

    58ece723af6a27e0125b846ea6b3edd5f64fe241

  • SHA256

    5c2f63b8821678ad4328e01f7b4512febdd8cff2ba762d6577744844514fbc3f

  • SHA512

    dc24e81ea1aee15e756347728914ee49b52ccb335ce1dc5e256d4e14a69ef1eb108aeb5067090edafb2c0fc1a8b8c7ecd8798a0c37721c79c5ea38c508f363e2

  • SSDEEP

    3072:n5j8GLg0XpaaTR2R/5uxsppYxiq8LszNKq/o40zwUzQRKF+:5JLg0XMRY6Ip8gzUQo40M2b

Score
10/10
danabotrhadamanthysbankerstealertrojan

Malware Config

Targets

    • Target

      5c2f63b8821678ad4328e01f7b4512febdd8cff2ba762d6577744844514fbc3f

    • Size

      214KB

    • MD5

      e05542960134ab0160c8c7f7a17aca89

    • SHA1

      58ece723af6a27e0125b846ea6b3edd5f64fe241

    • SHA256

      5c2f63b8821678ad4328e01f7b4512febdd8cff2ba762d6577744844514fbc3f

    • SHA512

      dc24e81ea1aee15e756347728914ee49b52ccb335ce1dc5e256d4e14a69ef1eb108aeb5067090edafb2c0fc1a8b8c7ecd8798a0c37721c79c5ea38c508f363e2

    • SSDEEP

      3072:n5j8GLg0XpaaTR2R/5uxsppYxiq8LszNKq/o40zwUzQRKF+:5JLg0XMRY6Ip8gzUQo40M2b

    Score
    10/10
    danabotrhadamanthysbankerstealertrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Detect rhadamanthys stealer shellcode

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks