Overview

overview

10

Static

static

lv.exe

windows7_x64

10

lv.exe

windows10_x64

10

Resubmissions

14-09-2021 09:06

210914-k2x6jaadeq 10

14-09-2021 08:57

210914-kw2a1afde8 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    lv.exe

  • Size

    4.2MB

  • Sample

    210914-kw2a1afde8

  • MD5

    1919bd531e95d9195dc53ee6af79ffc8

  • SHA1

    65c2dfb3ad6ff0b3f1b33db143ec9a65ea64e2b0

  • SHA256

    eb50c5447c789b7cab2a404cfbbd049c55fa70bc58783f2bb27df7d169474d27

  • SHA512

    b00029cdfeac8266653f2fefe07e40815c14c811dce68fc95b821a408f8cf60489366a461a1def3d423747a2f5559ce6c1acaee16a795d893036d2a8226ae9c6

Score
10/10
danabotbankerevasionthemidatrojan

Malware Config

Extracted

Family

danabot

C2

23.229.29.48:443

5.9.224.204:443

192.255.166.212:443
Attributes
  • embedded_hash

    0E1A7A1479C37094441FA911262B322A

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      lv.exe

    • Size

      4.2MB

    • MD5

      1919bd531e95d9195dc53ee6af79ffc8

    • SHA1

      65c2dfb3ad6ff0b3f1b33db143ec9a65ea64e2b0

    • SHA256

      eb50c5447c789b7cab2a404cfbbd049c55fa70bc58783f2bb27df7d169474d27

    • SHA512

      b00029cdfeac8266653f2fefe07e40815c14c811dce68fc95b821a408f8cf60489366a461a1def3d423747a2f5559ce6c1acaee16a795d893036d2a8226ae9c6

    Score
    10/10
    danabotbankerevasionthemidatrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot Loader Component

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Drops startup file

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

5
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks