Overview

overview

10

Static

static

532a8713a9...1d.exe

windows7_x64

10

532a8713a9...1d.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    532a8713a93fff1d9e111cfe310ec41d.exe

  • Size

    2.6MB

  • Sample

    201109-8kawwszx4s

  • MD5

    532a8713a93fff1d9e111cfe310ec41d

  • SHA1

    eb325a88f3aa5ef0bb0ad94cb1bbcb3b976f4029

  • SHA256

    98c2f70c665efdfe6ff95460c0c8f131e80de91cf6dcbcf8bb4209c330280262

  • SHA512

    02421b8f4688bfc8174a090c290b0f636df38eadef7bc95c0801cf32cccfcbf959b886a42b2c72296d77887ffce366e007bdaa62c323d7aa670c23b992972202

Score
10/10
danabotbankerbotnettrojan

Malware Config

Extracted

Family

danabot

C2

179.43.133.50

193.34.166.141

23.108.57.107

185.227.138.47

104.168.213.174

23.106.123.48
rsa_pubkey.plain

Targets

    • Target

      532a8713a93fff1d9e111cfe310ec41d.exe

    • Size

      2.6MB

    • MD5

      532a8713a93fff1d9e111cfe310ec41d

    • SHA1

      eb325a88f3aa5ef0bb0ad94cb1bbcb3b976f4029

    • SHA256

      98c2f70c665efdfe6ff95460c0c8f131e80de91cf6dcbcf8bb4209c330280262

    • SHA512

      02421b8f4688bfc8174a090c290b0f636df38eadef7bc95c0801cf32cccfcbf959b886a42b2c72296d77887ffce366e007bdaa62c323d7aa670c23b992972202

    Score
    10/10
    danabotbankerbotnettrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot x86 payload

      Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

      botnet

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks