Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bb4224740207c1f01def04918c03f64dae633f29a9ba9dd6c356875d2471e0b1

  • Size

    214KB

  • Sample

    221219-ded1tahb2z

  • MD5

    da869827ceb8735f02077a93299437e1

  • SHA1

    7555e80a95dbd4efdea2ddd7bc9b16a000cfdf27

  • SHA256

    bb4224740207c1f01def04918c03f64dae633f29a9ba9dd6c356875d2471e0b1

  • SHA512

    edf780e3ead0c23870694062b79ba901acd740d71bfe0c351a080e71dd679f6519b776852dd23a513059f53fbf88c907dd81828ea2b4ca7c2422ded05612a106

  • SSDEEP

    3072:2Xt/sLVgoaRqhK8RkuK3fU2JabogGtSilWaNRAtOba+HICuGujcbImdzmuX:2psLVgakEk13fUt0gmSilJ0uIfjcbXF

Score
10/10
danabotsmokeloaderbackdoorbankertrojan

Malware Config

Targets

    • Target

      bb4224740207c1f01def04918c03f64dae633f29a9ba9dd6c356875d2471e0b1

    • Size

      214KB

    • MD5

      da869827ceb8735f02077a93299437e1

    • SHA1

      7555e80a95dbd4efdea2ddd7bc9b16a000cfdf27

    • SHA256

      bb4224740207c1f01def04918c03f64dae633f29a9ba9dd6c356875d2471e0b1

    • SHA512

      edf780e3ead0c23870694062b79ba901acd740d71bfe0c351a080e71dd679f6519b776852dd23a513059f53fbf88c907dd81828ea2b4ca7c2422ded05612a106

    • SSDEEP

      3072:2Xt/sLVgoaRqhK8RkuK3fU2JabogGtSilWaNRAtOba+HICuGujcbImdzmuX:2psLVgakEk13fUt0gmSilJ0uIfjcbXF

    Score
    10/10
    danabotsmokeloaderbackdoorbankertrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks