General

  • Target

    b89e83a92394a63fd0569b9679b268cfe6e540f56e0853cd19f1bfba84280c8b

  • Size

    4MB

  • Sample

    220324-tm6zkafhhn

  • MD5

    cca3e81d4c0989cb039e39756424334e

  • SHA1

    2378f63c8b6a9ff911f7e3a41b84d534b3b5f42a

  • SHA256

    b89e83a92394a63fd0569b9679b268cfe6e540f56e0853cd19f1bfba84280c8b

  • SHA512

    66183f6b49ccfd5ebe5a53597c8b6f4fb6ccbbd63a7056e4a6fdcdbaaa4a0bfba1f19c133fea0c5c2dad7405fe3ce2129bdfe8383360afffea0c19efcc61bd6a

Malware Config

Extracted

Family

danabot

Version

1732

Botnet

3

C2

104.227.34.227:443

64.188.20.187:443

51.195.73.129:443

176.123.2.249:443

Attributes
  • embedded_hash

    6266E79288DFE2AE2C2DB47563C7F93A

  • type

    main

rsa_pubkey.plain
rsa_pubkey.plain

Targets

    • Target

      b89e83a92394a63fd0569b9679b268cfe6e540f56e0853cd19f1bfba84280c8b

    • Size

      4MB

    • MD5

      cca3e81d4c0989cb039e39756424334e

    • SHA1

      2378f63c8b6a9ff911f7e3a41b84d534b3b5f42a

    • SHA256

      b89e83a92394a63fd0569b9679b268cfe6e540f56e0853cd19f1bfba84280c8b

    • SHA512

      66183f6b49ccfd5ebe5a53597c8b6f4fb6ccbbd63a7056e4a6fdcdbaaa4a0bfba1f19c133fea0c5c2dad7405fe3ce2129bdfe8383360afffea0c19efcc61bd6a

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • suricata: ET MALWARE Danabot Key Exchange Request

      suricata: ET MALWARE Danabot Key Exchange Request

    • Blocklisted process makes network request

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops desktop.ini file(s)

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

1
T1005

Tasks