Overview

overview

10

Static

static

SecuriteIn...29.exe

windows7_x64

10

SecuriteIn...29.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Trojan.Siggen9.44975.24169.23729

  • Size

    940KB

  • Sample

    201109-ws2w17lll6

  • MD5

    90ed97fd14801fceaca28bf9e2ccb646

  • SHA1

    df8ed59f466cbe150e51924385f4151dace21283

  • SHA256

    5bc7a56b2dcc47933032f0ebde41aae2f6792e90c8a012a90ffc4ad824ee0abd

  • SHA512

    91539dc7c9aa4b1983060cd50803de0dda958872940209e8003f767cb929772e591fc71e5a9c3ab967ebf4745af15b26b7e1c6a06ed76fb65be24767fe86675c

Score
10/10
danabotbankerbotnettrojan

Malware Config

Extracted

Family

danabot

C2

54.38.22.65

192.99.219.207

51.255.134.130

192.236.179.73

23.82.140.201

172.81.129.196
rsa_pubkey.plain

Targets

    • Target

      SecuriteInfo.com.Trojan.Siggen9.44975.24169.23729

    • Size

      940KB

    • MD5

      90ed97fd14801fceaca28bf9e2ccb646

    • SHA1

      df8ed59f466cbe150e51924385f4151dace21283

    • SHA256

      5bc7a56b2dcc47933032f0ebde41aae2f6792e90c8a012a90ffc4ad824ee0abd

    • SHA512

      91539dc7c9aa4b1983060cd50803de0dda958872940209e8003f767cb929772e591fc71e5a9c3ab967ebf4745af15b26b7e1c6a06ed76fb65be24767fe86675c

    Score
    10/10
    danabotbankerbotnettrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot x86 payload

      Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

      botnet

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks