Triage | Malware sandboxing report by Hatching Triage

Sharing

General

Target

d8f1186979d8ff54e4d376cae7b5e20100a0b89776201c69514cef044f57bc8c
Size

1MB
Sample

220113-j9a6asggej
MD5

a012615d823d78cf7ebe845cfc2a2102
SHA1

769d1c1dbeb0ab368ed3c094d4a468903e7e1e01
SHA256

d8f1186979d8ff54e4d376cae7b5e20100a0b89776201c69514cef044f57bc8c
SHA512

dc6d135d2e6cf6f842e49a93a8a211f3a58c64236a8f8f9bd2bc75cacc64858e1d02c4cd1868fe870ba8d800485cea654551a2214d684b8d10689aee8cd21a5c

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family	danabot
Botnet	4
C2	103.175.16.113:443 103.175.16.114:443 103.175.16.113:443 103.175.16.114:443
Attributes	embedded_hash 422236FD601D11EE82825A484D26DD6F type loader
rsa_pubkey.plain
rsa_privkey.plain

Targets

- Target
  
  d8f1186979d8ff54e4d376cae7b5e20100a0b89776201c69514cef044f57bc8c
- Size
  
  1MB
- MD5
  
  a012615d823d78cf7ebe845cfc2a2102
- SHA1
  
  769d1c1dbeb0ab368ed3c094d4a468903e7e1e01
- SHA256
  
  d8f1186979d8ff54e4d376cae7b5e20100a0b89776201c69514cef044f57bc8c
- SHA512
  
  dc6d135d2e6cf6f842e49a93a8a211f3a58c64236a8f8f9bd2bc75cacc64858e1d02c4cd1868fe870ba8d800485cea654551a2214d684b8d10689aee8cd21a5c
Score

10^/10

danabot 4 banker trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Danabot Loader Component
- Loads dropped DLL
behavioral1

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Tasks

static1

behavioral1

danabot4bankertrojan