Overview

overview

10

Static

static

28ed6bbb72...c0.exe

windows7_x64

10

28ed6bbb72...c0.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    28ed6bbb727cd4066fb3aa4ec76fd8c0.exe

  • Size

    2.6MB

  • Sample

    201109-dd12ckq616

  • MD5

    28ed6bbb727cd4066fb3aa4ec76fd8c0

  • SHA1

    8a8b036d0a48acb9b685df15e5068de48df705ca

  • SHA256

    445bd58d9f401c7fb7d977e9b74cc002e5b892ba355f5c00e122cc48b404bac2

  • SHA512

    f8d1bb33cce2b58267a74a98132a37bf004f28c50b73bf310ac67fde10778420c5c519655968505a852c766a3c21a27af9479fb598d71e7ad9f5bd07fa9568e6

Score
10/10
danabotbankerbotnettrojan

Malware Config

Extracted

Family

danabot

C2

45.153.186.50

178.157.91.35

176.123.3.47

45.147.231.202

149.255.35.125
rsa_pubkey.plain

Targets

    • Target

      28ed6bbb727cd4066fb3aa4ec76fd8c0.exe

    • Size

      2.6MB

    • MD5

      28ed6bbb727cd4066fb3aa4ec76fd8c0

    • SHA1

      8a8b036d0a48acb9b685df15e5068de48df705ca

    • SHA256

      445bd58d9f401c7fb7d977e9b74cc002e5b892ba355f5c00e122cc48b404bac2

    • SHA512

      f8d1bb33cce2b58267a74a98132a37bf004f28c50b73bf310ac67fde10778420c5c519655968505a852c766a3c21a27af9479fb598d71e7ad9f5bd07fa9568e6

    Score
    10/10
    danabotbankerbotnettrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot x86 payload

      Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

      botnet

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks