SecuriteInfo.com.W32.AIDetect.malware1.2200.14031

General
Target

SecuriteInfo.com.W32.AIDetect.malware1.2200.14031

Size

5MB

Sample

210409-6r3wpys7kj

Score
10 /10
MD5

8489eaf91d0c39c9dcca9f1a6ca5af1d

SHA1

831ec0fa5cbff0997af659a62ddc3a0a25abedc8

SHA256

dc3d8c3f1d1991dca9dd82a1943e519e4049ee0a34f89af6c961adbfcd1a6918

SHA512

0a5b73b68d642d317f475c199f9e2a9aaedf0f73e9a507dc019d6b1d97528297e12df4e656ea9f916b6a331b6018f3f7e771bbea7e9d3040862d2f48e61f6fc4

Malware Config

Extracted

Family danabot
Version 1827
Botnet 3
C2

23.106.123.249:443

23.106.123.141:443

23.254.225.170:443

134.119.186.216:443

Attributes
embedded_hash
AEF96B4D339B580ABB737F203C2D0F52
rsa_pubkey.plain
rsa_pubkey.plain
Targets
Target

SecuriteInfo.com.W32.AIDetect.malware1.2200.14031

MD5

8489eaf91d0c39c9dcca9f1a6ca5af1d

Filesize

5MB

Score
10 /10
SHA1

831ec0fa5cbff0997af659a62ddc3a0a25abedc8

SHA256

dc3d8c3f1d1991dca9dd82a1943e519e4049ee0a34f89af6c961adbfcd1a6918

SHA512

0a5b73b68d642d317f475c199f9e2a9aaedf0f73e9a507dc019d6b1d97528297e12df4e656ea9f916b6a331b6018f3f7e771bbea7e9d3040862d2f48e61f6fc4

Tags

Signatures

  • Danabot

    Description

    Danabot is a modular banking Trojan that has been linked with other malware.

    Tags

  • Blocklisted process makes network request

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local System Credentials in Files
  • Checks installed software on the system

    Description

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    Tags

    TTPs

    Query Registry
  • Drops desktop.ini file(s)

Related Tasks

MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Execution
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Persistence
                  Privilege Escalation