danabot | 4112b8582507df49a04e8e827b6c2dca32873793b2967417b8e710fd9c5aa8e5 | Triage

Sharing

General

Target

4112b8582507df49a04e8e827b6c2dca32873793b2967417b8e710fd9c5aa8e5
Size

1.8MB
Sample

211229-2gft7adhdk
MD5

015478943e0fead234234874ec22be9a
SHA1

5067c01b467f83034dc7be492618eee126c26a26
SHA256

4112b8582507df49a04e8e827b6c2dca32873793b2967417b8e710fd9c5aa8e5
SHA512

7b4a52dd1c7e40621bb7fe4ce3bf637bb439f4a6bf03b51cd9137a45e4e204fda2e86f39b2889d6248ebcdc9e135e996022b6f0409dc35f09fb18fcfd0589596

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.244.223:443

192.236.194.72:443

Attributes

embedded_hash
0FA95F120D6EB149A5D48E36BC76879D
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Targets

- Target
  
  4112b8582507df49a04e8e827b6c2dca32873793b2967417b8e710fd9c5aa8e5
- Size
  
  1.8MB
- MD5
  
  015478943e0fead234234874ec22be9a
- SHA1
  
  5067c01b467f83034dc7be492618eee126c26a26
- SHA256
  
  4112b8582507df49a04e8e827b6c2dca32873793b2967417b8e710fd9c5aa8e5
- SHA512
  
  7b4a52dd1c7e40621bb7fe4ce3bf637bb439f4a6bf03b51cd9137a45e4e204fda2e86f39b2889d6248ebcdc9e135e996022b6f0409dc35f09fb18fcfd0589596
Score

10^/10

danabot 4 banker trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Loads dropped DLL
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

danabot4bankertrojan