danabot

Sharing

Copy URL

Twitter E-mail

General

Target

17A221ABA35622B614FD1C7581BD6B37.exe
Size

3.4MB
Sample

210602-4r3kppr3ms
MD5

17a221aba35622b614fd1c7581bd6b37
SHA1

6199856113f32005d86805feb650d5613a89a5c1
SHA256

7bede792f88ec33d71d4487bdbc4020f45ce1d4efc4b44f73b8cd9438cb5eae6
SHA512

315f0be1117813ab5a40bb3b531806ae069e8e10eaf9eefb7c0b19e78c422ba3dbc856dfc52dae47a707f8a08b7bdc25eadb8868181c74a65418443e7700a1a1

Malware Config

Extracted

Family

vidar

Version

38.9

Botnet

706

https://HAL9THapi.faceit.compavel23puef

Attributes

profile_id
706

Extracted

Family

smokeloader

Version

2020

http://ppcspb.com/upload/

http://mebbing.com/upload/

http://twcamel.com/upload/

http://howdycash.com/upload/

http://lahuertasonora.com/upload/

http://kpotiques.com/upload/

rc4.i32

Extracted

Family

redline

Botnet

ServJason

ergerge.top:80

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

redline

Botnet

1_06_ruz

quropaloar.xyz:80

Extracted

Family

danabot

Version

1827

Botnet

184.95.51.183:443

184.95.51.175:443

192.210.198.12:443

184.95.51.180:443

Attributes

embedded_hash
AEF96B4D339B580ABB737F203C2D0F52

rsa_pubkey.plain

Extracted

Family

redline

Botnet

first

157.90.145.89:45614

Targets

- Target
  
  17A221ABA35622B614FD1C7581BD6B37.exe
- Size
  
  3.4MB
- MD5
  
  17a221aba35622b614fd1c7581bd6b37
- SHA1
  
  6199856113f32005d86805feb650d5613a89a5c1
- SHA256
  
  7bede792f88ec33d71d4487bdbc4020f45ce1d4efc4b44f73b8cd9438cb5eae6
- SHA512
  
  315f0be1117813ab5a40bb3b531806ae069e8e10eaf9eefb7c0b19e78c422ba3dbc856dfc52dae47a707f8a08b7bdc25eadb8868181c74a65418443e7700a1a1
Score

10^/10

danabot glupteba metasploit redline smokeloader vidar 1_06_ruz 3 706 servjason aspackv2 backdoor banker discovery dropper infostealer loader persistence spyware stealer trojan upx vmprotect first
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba Payload
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar Stealer
  stealer
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Blocklisted process makes network request
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

Glupteba

Glupteba Payload

MetaSploit

RedLine

RedLine Payload

SmokeLoader

Suspicious use of NtCreateUserProcessOtherParentProcess

Vidar

Vidar Stealer

ASPack v2.12-2.42

Blocklisted process makes network request

Downloads MZ/PE file

Drops file in Drivers directory

Executes dropped EXE

UPX packed file

VMProtect packed file

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Drops desktop.ini file(s)

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2