danabot | cf4f27cdfaa338ca20522104b606e424e9cca6895403cf973fbc814966bfe61b | Triage

Sharing

General

Target

cf4f27cdfaa338ca20522104b606e424e9cca6895403cf973fbc814966bfe61b
Size

1.1MB
Sample

220106-vh9qbsbdf5
MD5

c5fa3f6f58f272f0e33f3d5bd061290e
SHA1

b4400c24f79d7214293393339e0585ea3ed479f6
SHA256

cf4f27cdfaa338ca20522104b606e424e9cca6895403cf973fbc814966bfe61b
SHA512

0511ba58e3b025012eaff66c868713af8d4cb04194e4c6e7426b1b45e8ca09ac061bdb67cb074ad3eb9ed0fc4fbbaa49b7186e93b5306503fbdbf9634d6e48a8

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.244.223:443

192.236.194.72:443

192.119.110.4:443

Attributes

embedded_hash
8357B947FCA843DB2D85EC29EDCDEF3C
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Targets

- Target
  
  cf4f27cdfaa338ca20522104b606e424e9cca6895403cf973fbc814966bfe61b
- Size
  
  1.1MB
- MD5
  
  c5fa3f6f58f272f0e33f3d5bd061290e
- SHA1
  
  b4400c24f79d7214293393339e0585ea3ed479f6
- SHA256
  
  cf4f27cdfaa338ca20522104b606e424e9cca6895403cf973fbc814966bfe61b
- SHA512
  
  0511ba58e3b025012eaff66c868713af8d4cb04194e4c6e7426b1b45e8ca09ac061bdb67cb074ad3eb9ed0fc4fbbaa49b7186e93b5306503fbdbf9634d6e48a8
Score

10^/10

danabot 4 banker trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Loads dropped DLL
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

danabot4bankertrojan