Overview

overview

10

Static

static

222_737_810158.vbs

windows7_x64

10

222_737_810158.vbs

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c78b136c2a0f03716aec3139a04b73edd8e5cd23fd0bd071c32ae32ea2d011ae

  • Size

    307KB

  • Sample

    220502-3cxskseehk

  • MD5

    29cd3645ec2154f65d1103fdc3cd73fd

  • SHA1

    bfbdefd49c6af558c06d9892f612798a74903f6a

  • SHA256

    c78b136c2a0f03716aec3139a04b73edd8e5cd23fd0bd071c32ae32ea2d011ae

  • SHA512

    279e83baf5c315f3b36140bd25bcbe1765b4191a92d0cd44ffd8b3899de8bd218fec2dc821d4cb9a08d98d6a4a9ccc49954560c3b7e840bcd7bcd43980e380ac

Score
10/10
danabotbankerbotnettrojan

Malware Config

Extracted

Family

danabot

C2

1.5.78.29

71.61.197.13

128.43.39.106

68.164.114.181

243.7.235.34

185.92.222.238

192.71.249.51

42.180.72.123

159.159.89.172

135.231.151.187
rsa_pubkey.plain

Targets

    • Target

      222_737_810158.vbs

    • Size

      1.4MB

    • MD5

      c5405d72402de5c0d7303bbcf0f701b6

    • SHA1

      f4bd158ef7e3f1d1fc66a2ebb0fe0f97d1328b25

    • SHA256

      031696a851471374edc973ea9fa0085bdf491e9874533fc75e827d8bef00e2c9

    • SHA512

      4fa90d32fda1201e162811c361ff2ebcccb521144fa7db844ec2bb0e3e379cd41e1a488bef62846d45b99f49aebb8ec2886e84c882c3d31e33e059936998ca71

    Score
    10/10
    danabotbankerbotnettrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot x86 payload

      Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

      botnet

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks