danabot

General

Target

f855a98d4367685b38e0c961627ef029.exe
Size

671KB
Sample

201202-r3gg35hyr2
MD5

f855a98d4367685b38e0c961627ef029
SHA1

f111814ebf9950785a8e932627abfae9c3ec24ef
SHA256

37cb831726dc1877ea59cf5618e4fa224368bbd64a7047dec6fb554a6a17d4c2
SHA512

c3e295ac5f46c8400ebe9846eaddea93b06f4023cc36751654ae9ff73f4dc0e33510fbe4ef2ebf9ff24328ac316158b77560620ad6db8d4dc8791756b1e7386c

Score

10^/10

danabot xmrig 3 banker discovery evasion miner spyware stealer trojan

Malware Config

Extracted

Family

danabot

Version

1732

Botnet

3

C2

104.227.34.227:443

64.188.20.187:443

51.195.73.129:443

176.123.2.249:443

Attributes

embedded_hash
6266E79288DFE2AE2C2DB47563C7F93A

rsa_pubkey.plain

Targets

- Target
  
  f855a98d4367685b38e0c961627ef029.exe
- Size
  
  671KB
- MD5
  
  f855a98d4367685b38e0c961627ef029
- SHA1
  
  f111814ebf9950785a8e932627abfae9c3ec24ef
- SHA256
  
  37cb831726dc1877ea59cf5618e4fa224368bbd64a7047dec6fb554a6a17d4c2
- SHA512
  
  c3e295ac5f46c8400ebe9846eaddea93b06f4023cc36751654ae9ff73f4dc0e33510fbe4ef2ebf9ff24328ac316158b77560620ad6db8d4dc8791756b1e7386c
Score

10^/10

danabot xmrig 3 banker discovery evasion miner spyware stealer trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Detected Stratum cryptominer command
  Looks to be attempting to contact Stratum mining pool.
  miner
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- XMRig Miner Payload
  miner
- Blocklisted process makes network request
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Deletes itself
- Drops startup file
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2