Overview

overview

10

Static

static

b6b8c3786d...a0.exe

windows7_x64

10

b6b8c3786d...a0.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b6b8c3786d083acd1def5d1ca92b0c505981bde8ce2304d6d159c142376f66a0

  • Size

    1.2MB

  • Sample

    220624-2c2absfdcr

  • MD5

    f0345563ece05e441e96aa1cbfeb4edd

  • SHA1

    ab4aa38faaae74314ae8b54ab28b77d7d75c1522

  • SHA256

    b6b8c3786d083acd1def5d1ca92b0c505981bde8ce2304d6d159c142376f66a0

  • SHA512

    5ef94563596e49d74b8e6c908971296b8b871ac576274d98e7af80b8c0d440e9de218c258330dadb9a6a7c0cd889c9c01479d4dea1dd410911e4eeedc6cc684e

Score
10/10
danabotbankerbotnettrojan

Malware Config

Extracted

Family

danabot

C2

45.74.187.0

146.1.214.150

158.228.122.53

202.136.199.125

149.28.180.182

4.79.227.177

44.151.109.26

178.209.51.211

167.196.69.157

149.143.183.11
rsa_pubkey.plain

Targets

    • Target

      b6b8c3786d083acd1def5d1ca92b0c505981bde8ce2304d6d159c142376f66a0

    • Size

      1.2MB

    • MD5

      f0345563ece05e441e96aa1cbfeb4edd

    • SHA1

      ab4aa38faaae74314ae8b54ab28b77d7d75c1522

    • SHA256

      b6b8c3786d083acd1def5d1ca92b0c505981bde8ce2304d6d159c142376f66a0

    • SHA512

      5ef94563596e49d74b8e6c908971296b8b871ac576274d98e7af80b8c0d440e9de218c258330dadb9a6a7c0cd889c9c01479d4dea1dd410911e4eeedc6cc684e

    Score
    10/10
    danabotbankerbotnettrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot x86 payload

      Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

      botnet

    • Blocklisted process makes network request

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks