General
-
Target
b89e83a92394a63fd0569b9679b268cfe6e540f56e0853cd19f1bfba84280c8b
-
Size
4MB
-
Sample
220324-tm6zkafhhn
-
MD5
cca3e81d4c0989cb039e39756424334e
-
SHA1
2378f63c8b6a9ff911f7e3a41b84d534b3b5f42a
-
SHA256
b89e83a92394a63fd0569b9679b268cfe6e540f56e0853cd19f1bfba84280c8b
-
SHA512
66183f6b49ccfd5ebe5a53597c8b6f4fb6ccbbd63a7056e4a6fdcdbaaa4a0bfba1f19c133fea0c5c2dad7405fe3ce2129bdfe8383360afffea0c19efcc61bd6a
Static task
static1
Behavioral task
behavioral1
Sample
b89e83a92394a63fd0569b9679b268cfe6e540f56e0853cd19f1bfba84280c8b.exe
Resource
win7-20220311-en
Malware Config
Extracted
danabot
1732
3
104.227.34.227:443
64.188.20.187:443
51.195.73.129:443
176.123.2.249:443
-
embedded_hash
6266E79288DFE2AE2C2DB47563C7F93A
-
type
main
Targets
-
-
Target
b89e83a92394a63fd0569b9679b268cfe6e540f56e0853cd19f1bfba84280c8b
-
Size
4MB
-
MD5
cca3e81d4c0989cb039e39756424334e
-
SHA1
2378f63c8b6a9ff911f7e3a41b84d534b3b5f42a
-
SHA256
b89e83a92394a63fd0569b9679b268cfe6e540f56e0853cd19f1bfba84280c8b
-
SHA512
66183f6b49ccfd5ebe5a53597c8b6f4fb6ccbbd63a7056e4a6fdcdbaaa4a0bfba1f19c133fea0c5c2dad7405fe3ce2129bdfe8383360afffea0c19efcc61bd6a
-
suricata: ET MALWARE Danabot Key Exchange Request
suricata: ET MALWARE Danabot Key Exchange Request
-
Blocklisted process makes network request
-
Deletes itself
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-