danabot

General

Target
ae8b40bdf27fcdd4bd5fef4c5b1448a9
Size 1.2MB
Sample210901-7gbc8sj7ae
SHA256 76481e75bf486a5a2dbff6bb550830404cc52ca59a8638e0c0df32d8b1b18d06
MD5 ae8b40bdf27fcdd4bd5fef4c5b1448a9
SHA1 35b99757e7185b527a6b6e304e3e87b20411dabc
SHA512 158fb5e85fdd9875f3fc74146fc3bb9af874becf9b9d1b71c81e6288604cc98c8c499be7c2f34cc6c2e2bc75cc1fdb78585bb5e90ca8c04d40ec72cc89dc94db
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

danabot

Version

2033

Botnet

4

C2

23.229.29.48:443
5.9.224.204:443
192.210.222.81:443

Attributes

embedded_hash
0E1A7A1479C37094441FA911262B322A

rsa_privkey.plain

rsa_pubkey.plain

Targets

- Target
  ae8b40bdf27fcdd4bd5fef4c5b1448a9
- Size 1.2MB
- SHA256 76481e75bf486a5a2dbff6bb550830404cc52ca59a8638e0c0df32d8b1b18d06
- MD5 ae8b40bdf27fcdd4bd5fef4c5b1448a9
- SHA1 35b99757e7185b527a6b6e304e3e87b20411dabc
- SHA512 158fb5e85fdd9875f3fc74146fc3bb9af874becf9b9d1b71c81e6288604cc98c8c499be7c2f34cc6c2e2bc75cc1fdb78585bb5e90ca8c04d40ec72cc89dc94db
- MD5 SHA1 SHA512
Score

10^/10

danabot 4 banker discovery trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Danabot Loader Component
- Suspicious use of NtCreateProcessExOtherParentProcess
- Blocklisted process makes network request
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Danabot Loader Component

Suspicious use of NtCreateProcessExOtherParentProcess

Blocklisted process makes network request

Loads dropped DLL

Checks installed software on the system

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2