General

  • Target

    54eb9469e2bc4989a1a12c2892b4c1a6f845ce490f9aa5d0edf1389410db717f

  • Size

    745KB

  • Sample

    220615-gtjrdsgfej

  • MD5

    123ad08a58c9b7110b40aee22479b6a8

  • SHA1

    f0d0a6944216bfd8f869c7df8b0219b8fc531e79

  • SHA256

    54eb9469e2bc4989a1a12c2892b4c1a6f845ce490f9aa5d0edf1389410db717f

  • SHA512

    d75d7985f5330a7c71f7b402c08f1a6efafb5ed17b602dc96887dc776ece8603aa19899be730d5f461d0c9ecc48e87884c69a591c0ab8a4aea4704d423a1eaa8

Malware Config

Extracted

Family

danabot

C2

214.117.153.178

254.72.43.217

150.116.120.176

199.21.37.100

46.168.211.8

175.16.177.89

17.31.87.118

95.179.168.37

117.111.1.23

207.148.83.108

rsa_pubkey.plain

Targets

    • Target

      Receipt#2019#6dee13ba19fcef2b7b9c5f05086580cb1.vbs

    • Size

      4.9MB

    • MD5

      f3ed87b32b193290549208db85679ca6

    • SHA1

      ba83a0ec36bcf851b9a12bcaf545973f7499193c

    • SHA256

      4747f8d0515a3209e45ffdb4fe25cf62f8b5db48faff4357362c45d56e25db83

    • SHA512

      bcdcd1fa7b075d99ccb982ea81fef77fc6b51f10fd3e8f6be88f7abeb74f4f410d9752077233a71929520c4b9cd54c6ec770fb0e41ee178fd865252f446169e9

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Danabot x86 payload

      Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks