danabot | 9a8418ab244c91ab1447181ca5544cc1202c1e5aee5549e0e9908ac5080ed3a6 | Triage

Sharing

General

Target

9a8418ab244c91ab1447181ca5544cc1202c1e5aee5549e0e9908ac5080ed3a6
Size

1.1MB
Sample

220106-v9n8psbdh7
MD5

7d73bbc0c762f65500d81187cabb075d
SHA1

e8a1f531e3ad3a1ee0fecccf34d0f23b6f452a53
SHA256

9a8418ab244c91ab1447181ca5544cc1202c1e5aee5549e0e9908ac5080ed3a6
SHA512

83455a8f8dbcfb90bcd7a4538dbc89d799710489e21d17cda7a2cdebbcc6679ae2e027835aa4c20de63c75451af37c3ebb614d6217dc81fe10db0055dfb9ec57

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.244.223:443

192.236.194.72:443

192.119.110.4:443

Attributes

embedded_hash
8357B947FCA843DB2D85EC29EDCDEF3C
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Targets

- Target
  
  9a8418ab244c91ab1447181ca5544cc1202c1e5aee5549e0e9908ac5080ed3a6
- Size
  
  1.1MB
- MD5
  
  7d73bbc0c762f65500d81187cabb075d
- SHA1
  
  e8a1f531e3ad3a1ee0fecccf34d0f23b6f452a53
- SHA256
  
  9a8418ab244c91ab1447181ca5544cc1202c1e5aee5549e0e9908ac5080ed3a6
- SHA512
  
  83455a8f8dbcfb90bcd7a4538dbc89d799710489e21d17cda7a2cdebbcc6679ae2e027835aa4c20de63c75451af37c3ebb614d6217dc81fe10db0055dfb9ec57
Score

10^/10

danabot 4 banker trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Loads dropped DLL
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

danabot4bankertrojan