a24309574ec527a9474fbcf394e632c6ac7ef05475d1b714f0c29dd27c02ebe3

General
Target

a24309574ec527a9474fbcf394e632c6ac7ef05475d1b714f0c29dd27c02ebe3

Size

1MB

Sample

211021-skpf3aadh9

Score
10 /10
MD5

6fab8a5c4857f53a14e1b55206946922

SHA1

3fa5528f0c01dc24c5eede5d1babea1b7d43b703

SHA256

a24309574ec527a9474fbcf394e632c6ac7ef05475d1b714f0c29dd27c02ebe3

SHA512

900970fe482bb6528088d9b80fe33315259c3c5e1dc97e23d5620f093a3af9d1b609244530524736bc2df4d313ded40c474dd4191e19fec3227d6438881faacf

Malware Config

Extracted

Family danabot
C2

192.119.110.73:443

192.236.147.159:443

192.210.222.88:443

Attributes
embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
type
loader
rsa_pubkey.plain
rsa_privkey.plain
Targets
Target

a24309574ec527a9474fbcf394e632c6ac7ef05475d1b714f0c29dd27c02ebe3

MD5

6fab8a5c4857f53a14e1b55206946922

Filesize

1MB

Score
10/10
SHA1

3fa5528f0c01dc24c5eede5d1babea1b7d43b703

SHA256

a24309574ec527a9474fbcf394e632c6ac7ef05475d1b714f0c29dd27c02ebe3

SHA512

900970fe482bb6528088d9b80fe33315259c3c5e1dc97e23d5620f093a3af9d1b609244530524736bc2df4d313ded40c474dd4191e19fec3227d6438881faacf

Tags

Signatures

  • Danabot

    Description

    Danabot is a modular banking Trojan that has been linked with other malware.

    Tags

  • Danabot Loader Component

  • Blocklisted process makes network request

  • Loads dropped DLL

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Tasks

                          static1

                          behavioral1

                          10/10