Overview

overview

10

Static

static

SecuriteIn...56.exe

windows7_x64

10

SecuriteIn...56.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.BehavesLike.Win32.Generic.vc.4956

  • Size

    2.6MB

  • Sample

    200624-wwfax5qafs

  • MD5

    4a1c3c28361ddbf3bb561482fac48a13

  • SHA1

    c68d711aa133dab19ca4e8a0b75b6a9230d7b8e6

  • SHA256

    2aa79c5cfd9e657abd3eea42ddc3b31d44123e4fd14be4d4bcd7057b036c169b

  • SHA512

    c40de41edac45124e65fb246a92db686c8e4f8a7c6e0b3f04215ac63f1ee40dccaad74d179289f0ca019c4b4b0b0d0b60a1c3ac0f80dab59c8c0856bf661bb43

Score
10/10
danabotbankerbotnettrojan

Malware Config

Extracted

Family

danabot

C2

92.204.160.126

193.34.166.26

93.115.22.159

93.115.22.165

185.227.138.52
rsa_pubkey.plain

Targets

    • Target

      SecuriteInfo.com.BehavesLike.Win32.Generic.vc.4956

    • Size

      2.6MB

    • MD5

      4a1c3c28361ddbf3bb561482fac48a13

    • SHA1

      c68d711aa133dab19ca4e8a0b75b6a9230d7b8e6

    • SHA256

      2aa79c5cfd9e657abd3eea42ddc3b31d44123e4fd14be4d4bcd7057b036c169b

    • SHA512

      c40de41edac45124e65fb246a92db686c8e4f8a7c6e0b3f04215ac63f1ee40dccaad74d179289f0ca019c4b4b0b0d0b60a1c3ac0f80dab59c8c0856bf661bb43

    Score
    10/10
    danabotbankerbotnettrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot x86 payload

      Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

      botnet

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks