Overview

overview

10

Static

static

2d673fcd21...09.exe

windows7_x64

10

2d673fcd21...09.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2d673fcd210cfad92825862e017eaa09.exe

  • Size

    2.8MB

  • Sample

    201109-13crrljpqx

  • MD5

    2d673fcd210cfad92825862e017eaa09

  • SHA1

    531ac29cd36abba042f352983d9fcde29a987473

  • SHA256

    a13c95a98b340edd7eeeff2da8272761cd84d093f43888e5940451d02b1a2dc0

  • SHA512

    bac7a6decd497e06f4670b8439f830c9dbfdcfb5f9862f0304792f88748a6ebbf64d00c13ca512f85887c9f5608249b7bb642da1ff8c6d324400bacd86d741b0

Score
10/10
danabotbankerbotnettrojan

Malware Config

Extracted

Family

danabot

C2

37.120.145.180

95.174.65.203

51.77.7.204

192.236.160.191

193.34.167.174

185.227.138.47
rsa_pubkey.plain

Targets

    • Target

      2d673fcd210cfad92825862e017eaa09.exe

    • Size

      2.8MB

    • MD5

      2d673fcd210cfad92825862e017eaa09

    • SHA1

      531ac29cd36abba042f352983d9fcde29a987473

    • SHA256

      a13c95a98b340edd7eeeff2da8272761cd84d093f43888e5940451d02b1a2dc0

    • SHA512

      bac7a6decd497e06f4670b8439f830c9dbfdcfb5f9862f0304792f88748a6ebbf64d00c13ca512f85887c9f5608249b7bb642da1ff8c6d324400bacd86d741b0

    Score
    10/10
    danabotbankerbotnettrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot x86 payload

      Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

      botnet

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks