Overview

overview

10

Static

static

2e63e9d30b...cb.exe

windows7_x64

10

2e63e9d30b...cb.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2e63e9d30b26db39bd24c66b385b48cb.exe

  • Size

    2.7MB

  • Sample

    201109-56bkfft4wj

  • MD5

    2e63e9d30b26db39bd24c66b385b48cb

  • SHA1

    410a7bd32b78f8b501c8049e01ae0754d1d27086

  • SHA256

    b7aaf5ad482d87c9d03c2d33d9757cc6c675091e54b8f253406a53c4d0ac157c

  • SHA512

    f2a6e76923fc1eec240af9efcbcc59d2b1b6adb10483f5ad587cbecab5628217f65d7d51a7659faf604bc928f468d459695a843839da71d55561e0edce86f4ab

Score
10/10
danabotbankerbotnettrojan

Malware Config

Extracted

Family

danabot

C2

179.43.133.50

193.34.166.141

23.108.57.107

185.227.138.47

104.168.213.174

23.106.123.48
rsa_pubkey.plain

Targets

    • Target

      2e63e9d30b26db39bd24c66b385b48cb.exe

    • Size

      2.7MB

    • MD5

      2e63e9d30b26db39bd24c66b385b48cb

    • SHA1

      410a7bd32b78f8b501c8049e01ae0754d1d27086

    • SHA256

      b7aaf5ad482d87c9d03c2d33d9757cc6c675091e54b8f253406a53c4d0ac157c

    • SHA512

      f2a6e76923fc1eec240af9efcbcc59d2b1b6adb10483f5ad587cbecab5628217f65d7d51a7659faf604bc928f468d459695a843839da71d55561e0edce86f4ab

    Score
    10/10
    danabotbankerbotnettrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot x86 payload

      Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

      botnet

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks