Overview

overview

10

Static

static

1e1cddbcfb...b4.exe

windows7_x64

10

1e1cddbcfb...b4.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1e1cddbcfb56b0f20604fa6db7c9d8b4.exe

  • Size

    2.7MB

  • Sample

    201109-at81kxs8cs

  • MD5

    1e1cddbcfb56b0f20604fa6db7c9d8b4

  • SHA1

    c3ab4a02f2b9f53964d6ac8d26fd65f2a9bfa80f

  • SHA256

    ba3478006a8f45f9979a6f2f363933093cd063f7845c85dc604c374481347c20

  • SHA512

    c3db9d3099ebc810fbdd0f777efd8cca0ae87b59913dbe8bac7010fc484d2df092069e167b27bd49a2d1af997e2fb4a7e001db3e414f14b35a6b86ade15a54bf

Score
10/10
danabotbankerbotnettrojan

Malware Config

Extracted

Family

danabot

C2

179.43.133.50

193.34.166.141

23.108.57.107

185.227.138.47

104.168.213.174

23.106.123.48
rsa_pubkey.plain

Targets

    • Target

      1e1cddbcfb56b0f20604fa6db7c9d8b4.exe

    • Size

      2.7MB

    • MD5

      1e1cddbcfb56b0f20604fa6db7c9d8b4

    • SHA1

      c3ab4a02f2b9f53964d6ac8d26fd65f2a9bfa80f

    • SHA256

      ba3478006a8f45f9979a6f2f363933093cd063f7845c85dc604c374481347c20

    • SHA512

      c3db9d3099ebc810fbdd0f777efd8cca0ae87b59913dbe8bac7010fc484d2df092069e167b27bd49a2d1af997e2fb4a7e001db3e414f14b35a6b86ade15a54bf

    Score
    10/10
    danabotbankerbotnettrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot x86 payload

      Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

      botnet

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks