danabot | 11ad6a2816687b70968f90ef3c5489f98cb38d04be064d1834ed7d23ed3338fc | Triage

Sharing

General

Target

SecuriteInfo.com.W32.AIDetect.malware1.12135.10971
Size

5.9MB
Sample

210409-r2r3w458aj
MD5

a1d41370fa33850a53da98f69c4bf735
SHA1

0bdab47ba112c6639077c740d5d659e53edb6ea7
SHA256

11ad6a2816687b70968f90ef3c5489f98cb38d04be064d1834ed7d23ed3338fc
SHA512

a37006945a93f2555b870c24f35600c50477c162d2ef7a66e5ca65f7384075b9259e0bcd4f5e66d46914e5b38e295be837fa54e5c4073f0887bbc61e14f6ebe1

Score

10^/10

danabot 3 banker discovery spyware stealer trojan

Malware Config

Extracted

Family

danabot

Version

1827

Botnet

3

C2

193.34.167.88:443

192.210.198.12:443

23.81.246.201:443

192.3.26.107:443

Attributes

embedded_hash
AEF96B4D339B580ABB737F203C2D0F52

rsa_pubkey.plain

rsa_pubkey.plain

Targets

- Target
  
  SecuriteInfo.com.W32.AIDetect.malware1.12135.10971
- Size
  
  5.9MB
- MD5
  
  a1d41370fa33850a53da98f69c4bf735
- SHA1
  
  0bdab47ba112c6639077c740d5d659e53edb6ea7
- SHA256
  
  11ad6a2816687b70968f90ef3c5489f98cb38d04be064d1834ed7d23ed3338fc
- SHA512
  
  a37006945a93f2555b870c24f35600c50477c162d2ef7a66e5ca65f7384075b9259e0bcd4f5e66d46914e5b38e295be837fa54e5c4073f0887bbc61e14f6ebe1
Score

10^/10

danabot 3 banker discovery spyware stealer trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Blocklisted process makes network request
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

danabot3bankerdiscoveryspywarestealertrojan

behavioral2

danabot3bankerdiscoveryspywarestealertrojan