danabot | f1e6a7f3c522f5df0728be7a6e1a04ed52235cafb366db8a139f513742b1dbd9 | Triage

Sharing

General

Target

f1e6a7f3c522f5df0728be7a6e1a04ed52235cafb366db8a139f513742b1dbd9
Size

1.1MB
Sample

220106-j8jfaabba4
MD5

41d64125e3e8cf8ed38a35652e279390
SHA1

d01ad1e4b5435b2ff6be6831faf95bb04aa4058d
SHA256

f1e6a7f3c522f5df0728be7a6e1a04ed52235cafb366db8a139f513742b1dbd9
SHA512

90985d858e8da45303c4ef28997dbd4c47d7ea45ad39437578025df48214b27aedb5a406555c89ba3ad9de9ccbb053b9796ae0b3998ccb9ddb72182ff7347cdb

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.244.223:443

192.236.194.72:443

192.119.110.4:443

Attributes

embedded_hash
8357B947FCA843DB2D85EC29EDCDEF3C
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Targets

- Target
  
  f1e6a7f3c522f5df0728be7a6e1a04ed52235cafb366db8a139f513742b1dbd9
- Size
  
  1.1MB
- MD5
  
  41d64125e3e8cf8ed38a35652e279390
- SHA1
  
  d01ad1e4b5435b2ff6be6831faf95bb04aa4058d
- SHA256
  
  f1e6a7f3c522f5df0728be7a6e1a04ed52235cafb366db8a139f513742b1dbd9
- SHA512
  
  90985d858e8da45303c4ef28997dbd4c47d7ea45ad39437578025df48214b27aedb5a406555c89ba3ad9de9ccbb053b9796ae0b3998ccb9ddb72182ff7347cdb
Score

10^/10

danabot 4 banker trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Loads dropped DLL
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

danabot4bankertrojan