Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a188a7591b9d41088a8fa766bd9941ad91c75b0e9e7a17a495dfdc215caa1962

  • Size

    220KB

  • Sample

    221221-jpxhsseh9z

  • MD5

    276e04678fa2905941b386c8bac0cd9d

  • SHA1

    1a9dfd3e3a31e05fddf6029ffb7a8812a27de5da

  • SHA256

    a188a7591b9d41088a8fa766bd9941ad91c75b0e9e7a17a495dfdc215caa1962

  • SHA512

    de28819226f7aa7650d20d6983df4df437bd4c56ba570378c6c27fb8e1d43ce8e225532675e58743fb520f5231a15b6f13bb4d3bda73f037c0aa89cff7729df7

  • SSDEEP

    3072:nYtA0Lv4t15nTYb9FUG444voX8PHtHMD9V+UzKKjphlji7b/PnOoYNHCDml:YHLv4sqw8ftHkUUzKKFW3nqCa

Score
10/10
danabotbankertrojan

Malware Config

Targets

    • Target

      a188a7591b9d41088a8fa766bd9941ad91c75b0e9e7a17a495dfdc215caa1962

    • Size

      220KB

    • MD5

      276e04678fa2905941b386c8bac0cd9d

    • SHA1

      1a9dfd3e3a31e05fddf6029ffb7a8812a27de5da

    • SHA256

      a188a7591b9d41088a8fa766bd9941ad91c75b0e9e7a17a495dfdc215caa1962

    • SHA512

      de28819226f7aa7650d20d6983df4df437bd4c56ba570378c6c27fb8e1d43ce8e225532675e58743fb520f5231a15b6f13bb4d3bda73f037c0aa89cff7729df7

    • SSDEEP

      3072:nYtA0Lv4t15nTYb9FUG444voX8PHtHMD9V+UzKKjphlji7b/PnOoYNHCDml:YHLv4sqw8ftHkUUzKKFW3nqCa

    Score
    10/10
    danabotbankertrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks