Overview

overview

10

Static

static

34e619de04...27.exe

windows7_x64

10

34e619de04...27.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    34e619de046404d3aeb191bee99a5bc97ca4808e2afa1f3a8a3c3e028389bf27

  • Size

    2.6MB

  • Sample

    220524-s7yy1sgde9

  • MD5

    a329c16a70ac8358873a86b686537e6f

  • SHA1

    586b589ce774d8778f303d2a2a0f0a3edcc020b2

  • SHA256

    34e619de046404d3aeb191bee99a5bc97ca4808e2afa1f3a8a3c3e028389bf27

  • SHA512

    faa867337e45caec169af27369b519e217601baa9fa251f3cf49818dc284d7f2c0c03b98689f78003273f7c0546a1c1c5e570ab1b435d4480166f41d5a295bc9

Score
10/10
danabotbankerbotnettrojan

Malware Config

Extracted

Family

danabot

C2

45.147.231.202

23.83.133.10

137.74.66.92

185.227.138.52

192.236.146.249

149.255.35.125
rsa_pubkey.plain

Targets

    • Target

      34e619de046404d3aeb191bee99a5bc97ca4808e2afa1f3a8a3c3e028389bf27

    • Size

      2.6MB

    • MD5

      a329c16a70ac8358873a86b686537e6f

    • SHA1

      586b589ce774d8778f303d2a2a0f0a3edcc020b2

    • SHA256

      34e619de046404d3aeb191bee99a5bc97ca4808e2afa1f3a8a3c3e028389bf27

    • SHA512

      faa867337e45caec169af27369b519e217601baa9fa251f3cf49818dc284d7f2c0c03b98689f78003273f7c0546a1c1c5e570ab1b435d4480166f41d5a295bc9

    Score
    10/10
    danabotbankerbotnettrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot x86 payload

      Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

      botnet

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks