a3d561d70f54d321cfa0cff6eaa7755dfc632a89d9428a77dec6bca602c41e3c

General
Target

a3d561d70f54d321cfa0cff6eaa7755dfc632a89d9428a77dec6bca602c41e3c

Size

1MB

Sample

211004-kycenagbck

Score
10 /10
MD5

03e5fdc1250c5ee84ae9b36f3c3c71ad

SHA1

ec9b8f0e31741137501bd7a87fed2fc57c2d807e

SHA256

a3d561d70f54d321cfa0cff6eaa7755dfc632a89d9428a77dec6bca602c41e3c

SHA512

6aa084b10ee3c0ac4353de924b964b2516c4f2b0204a09eabe52641435f487c2528148a324ea4c0c61107c35543a384f92e9c8c3694a6635d590e9cb1ab151f7

Malware Config

Extracted

Family danabot
C2

142.11.192.232:443

192.119.110.73:443

142.11.242.31:443

192.210.222.88:443

Attributes
embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
type
loader
rsa_pubkey.plain
rsa_privkey.plain
Targets
Target

a3d561d70f54d321cfa0cff6eaa7755dfc632a89d9428a77dec6bca602c41e3c

MD5

03e5fdc1250c5ee84ae9b36f3c3c71ad

Filesize

1MB

Score
10/10
SHA1

ec9b8f0e31741137501bd7a87fed2fc57c2d807e

SHA256

a3d561d70f54d321cfa0cff6eaa7755dfc632a89d9428a77dec6bca602c41e3c

SHA512

6aa084b10ee3c0ac4353de924b964b2516c4f2b0204a09eabe52641435f487c2528148a324ea4c0c61107c35543a384f92e9c8c3694a6635d590e9cb1ab151f7

Tags

Signatures

  • Danabot

    Description

    Danabot is a modular banking Trojan that has been linked with other malware.

    Tags

  • Blocklisted process makes network request

  • Loads dropped DLL

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Tasks

                          static1

                          behavioral1

                          10/10