Overview

overview

10

Static

static

911b807a2a...37.exe

windows7_x64

10

911b807a2a...37.exe

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    911b807a2a4c688eb144d68d04b07b51618fc9d3fd2121c2e594b1b30f5bfe37

  • Size

    2.7MB

  • Sample

    220524-ts7s2sdadl

  • MD5

    073c564f8a966d72d4b8371ad315dfda

  • SHA1

    9a4833fb2ee1f675c6e43e85c1af476fa280e287

  • SHA256

    911b807a2a4c688eb144d68d04b07b51618fc9d3fd2121c2e594b1b30f5bfe37

  • SHA512

    88081fa2cc422741d839af530c9da964dcfd55cd2c7cbbbb0a7e171f9178b477d31da08ba3d6ed65761a35ad9357d2eec3bab4e12d2a8ca38d3b9bc10535eb30

Score
10/10
danabotbankerbotnettrojan

Malware Config

Extracted

Family

danabot

C2

185.227.138.47

38.68.50.140

2.56.212.64

38.68.50.172

172.241.27.92

193.34.167.159

179.43.133.50
rsa_pubkey.plain

Targets

    • Target

      911b807a2a4c688eb144d68d04b07b51618fc9d3fd2121c2e594b1b30f5bfe37

    • Size

      2.7MB

    • MD5

      073c564f8a966d72d4b8371ad315dfda

    • SHA1

      9a4833fb2ee1f675c6e43e85c1af476fa280e287

    • SHA256

      911b807a2a4c688eb144d68d04b07b51618fc9d3fd2121c2e594b1b30f5bfe37

    • SHA512

      88081fa2cc422741d839af530c9da964dcfd55cd2c7cbbbb0a7e171f9178b477d31da08ba3d6ed65761a35ad9357d2eec3bab4e12d2a8ca38d3b9bc10535eb30

    Score
    10/10
    danabotbankerbotnettrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot x86 payload

      Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

      botnet

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks