danabot | 838e44e6da7db03394079ccc8854b7f77b26da01881e78148b2ef80e7344dd45 | Triage

Sharing

General

Target

SecuriteInfo.com.W32.AIDetect.malware1.28672.16827
Size

5.9MB
Sample

210409-dmax6w91z6
MD5

e663bcd4d806dd560d265cb0a77bdeb0
SHA1

5b523fc0b6faf4f9c28d4e1bdc78435373b9acdb
SHA256

838e44e6da7db03394079ccc8854b7f77b26da01881e78148b2ef80e7344dd45
SHA512

7ffdc957074e8cee68304f41eb16839994bd71eebc8b2de28a47ad74367fb6d8e04f8262522289d502b84edd2081010bdaa29c1276eea7ec8acc88c361155152

Score

10^/10

danabot 3 banker discovery spyware stealer trojan

Malware Config

Extracted

Family

danabot

Version

1827

Botnet

3

C2

193.34.167.88:443

192.210.198.12:443

23.81.246.201:443

192.3.26.107:443

Attributes

embedded_hash
AEF96B4D339B580ABB737F203C2D0F52

rsa_pubkey.plain

rsa_pubkey.plain

Targets

- Target
  
  SecuriteInfo.com.W32.AIDetect.malware1.28672.16827
- Size
  
  5.9MB
- MD5
  
  e663bcd4d806dd560d265cb0a77bdeb0
- SHA1
  
  5b523fc0b6faf4f9c28d4e1bdc78435373b9acdb
- SHA256
  
  838e44e6da7db03394079ccc8854b7f77b26da01881e78148b2ef80e7344dd45
- SHA512
  
  7ffdc957074e8cee68304f41eb16839994bd71eebc8b2de28a47ad74367fb6d8e04f8262522289d502b84edd2081010bdaa29c1276eea7ec8acc88c361155152
Score

10^/10

danabot 3 banker discovery spyware stealer trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Blocklisted process makes network request
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

danabot3bankerdiscoveryspywarestealertrojan

behavioral2

danabot3bankerdiscoveryspywarestealertrojan