danabot

General

Target

719694DFB934F138D996919703BFC867.exe
Size

4.2MB
Sample

210531-z981sgvvb2
MD5

719694dfb934f138d996919703bfc867
SHA1

dc22f30aa998372eb206cb50f6947f7d29b43f6e
SHA256

2e32799ea160a52100d3e33de1b9b6fd33c38452a86d0b77cb7d17bdeb4f71f7
SHA512

f98f3b4ed895a3b90cdb92c43ce80e35c0d5aca46b906822d98cda902b13c98446304dad7306fb10186d78eea2e10151749329a0f3512ce3dc1890927c578c8a

Malware Config

Extracted

Family

vidar

Version

38.9

Botnet

706

C2

https://HAL9THapi.faceit.compavel23puef

Attributes

profile_id
706

Extracted

Family

smokeloader

Version

2020

C2

http://ppcspb.com/upload/

http://mebbing.com/upload/

http://twcamel.com/upload/

http://howdycash.com/upload/

http://lahuertasonora.com/upload/

http://kpotiques.com/upload/

rc4.i32

Extracted

Family

danabot

Version

1827

Botnet

3

C2

184.95.51.183:443

184.95.51.175:443

192.210.198.12:443

184.95.51.180:443

Attributes

embedded_hash
AEF96B4D339B580ABB737F203C2D0F52

rsa_pubkey.plain

Extracted

Family

metasploit

Version

windows/single_exec

Targets

- Target
  
  719694DFB934F138D996919703BFC867.exe
- Size
  
  4.2MB
- MD5
  
  719694dfb934f138d996919703bfc867
- SHA1
  
  dc22f30aa998372eb206cb50f6947f7d29b43f6e
- SHA256
  
  2e32799ea160a52100d3e33de1b9b6fd33c38452a86d0b77cb7d17bdeb4f71f7
- SHA512
  
  f98f3b4ed895a3b90cdb92c43ce80e35c0d5aca46b906822d98cda902b13c98446304dad7306fb10186d78eea2e10151749329a0f3512ce3dc1890927c578c8a
Score

10^/10

danabot glupteba metasploit redline smokeloader vidar 3 706 aspackv2 backdoor banker discovery dropper evasion infostealer loader persistence spyware stealer trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba Payload
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Vidar Stealer
  stealer
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Blocklisted process makes network request
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2