Overview

overview

10

Static

static

siri_not_active.exe

windows7_x64

10

siri_not_active.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    siri_not_active

  • Size

    2.6MB

  • Sample

    201117-thejfb7ezj

  • MD5

    7f405e39b0e2d51f2bf365993b72dca2

  • SHA1

    14395e68bc6b7e86b56b258ca5cdd4201a27eca7

  • SHA256

    11afae0272d2ad69e2942c99d3d4dbd6fa64ac50c2cc4130e5f6fab8190dd0c1

  • SHA512

    995c6af461f1c44aa3e6c18321a5c0ab3fb57ee07a70043c9eaf8194ea07ba0d6eb29a609653459ceb4baf2e246cadd55ebd94506896fad5b32af5f46ebd315a

Score
10/10
danabotbankerbotnettrojan

Malware Config

Extracted

Family

danabot

C2

51.178.195.151

51.222.39.81

149.255.35.125

38.68.50.179

51.77.7.204
rsa_pubkey.plain

Targets

    • Target

      siri_not_active

    • Size

      2.6MB

    • MD5

      7f405e39b0e2d51f2bf365993b72dca2

    • SHA1

      14395e68bc6b7e86b56b258ca5cdd4201a27eca7

    • SHA256

      11afae0272d2ad69e2942c99d3d4dbd6fa64ac50c2cc4130e5f6fab8190dd0c1

    • SHA512

      995c6af461f1c44aa3e6c18321a5c0ab3fb57ee07a70043c9eaf8194ea07ba0d6eb29a609653459ceb4baf2e246cadd55ebd94506896fad5b32af5f46ebd315a

    Score
    10/10
    danabotbankerbotnettrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot x86 payload

      Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

      botnet

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks