Overview

overview

10

Static

static

SecuriteIn...39.exe

windows7_x64

10

SecuriteIn...39.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Variant.Danabot.2.3619.11339

  • Size

    920KB

  • Sample

    200625-qx6s244qjs

  • MD5

    aa9d791d36be565f6d537f34f0ed9f6e

  • SHA1

    bab4cf9b752885788d4f07c42a5dcca42b1193b6

  • SHA256

    e444e98ee06dc0e26cae8aa57a0cddab7b050db22d3002bd2b0da47d4fd5d78c

  • SHA512

    cab24f89b5172827fb0fd31e9d97fc3879fdbf3e9c19f8de8147f7ebdf95373c1e56acc5a5fa2c9dc5c46c73007f1520ee62f45b84ac5a3795c7b2d24326c5f5

Score
10/10
danabotbankerbotnettrojan

Malware Config

Extracted

Family

danabot

C2

45.11.183.43

185.101.92.195

185.101.92.201
rsa_pubkey.plain

Targets

    • Target

      SecuriteInfo.com.Variant.Danabot.2.3619.11339

    • Size

      920KB

    • MD5

      aa9d791d36be565f6d537f34f0ed9f6e

    • SHA1

      bab4cf9b752885788d4f07c42a5dcca42b1193b6

    • SHA256

      e444e98ee06dc0e26cae8aa57a0cddab7b050db22d3002bd2b0da47d4fd5d78c

    • SHA512

      cab24f89b5172827fb0fd31e9d97fc3879fdbf3e9c19f8de8147f7ebdf95373c1e56acc5a5fa2c9dc5c46c73007f1520ee62f45b84ac5a3795c7b2d24326c5f5

    Score
    10/10
    danabotbankerbotnettrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot x86 payload

      Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

      botnet

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks