General
-
Target
95abee4d159f541d81c84f6eb33a9bba7b5d1d7293e89857390b15498e138e51
-
Size
1.1MB
-
Sample
220625-141mfaeaeq
-
MD5
fe9946e628607b7d1f5b975bdd863000
-
SHA1
91fec6fb060ecb82fad71200cd75d11c8a610e40
-
SHA256
95abee4d159f541d81c84f6eb33a9bba7b5d1d7293e89857390b15498e138e51
-
SHA512
8882ef3f7629dd0372e4d03f9098c323544f7e38758ccccb0e66e3f3bccf8b90e4672a76a606c5938603d9190899894916975b1ca3ba0eaa067ed57968f682cc
Static task
static1
Behavioral task
behavioral1
Sample
95abee4d159f541d81c84f6eb33a9bba7b5d1d7293e89857390b15498e138e51.js
Resource
win7-20220414-en
Malware Config
Extracted
danabot
89.144.25.243
14.123.141.112
91.121.17.109
97.144.123.166
89.144.25.104
37.96.21.198
26.18.85.30
88.132.191.2
106.9.214.152
161.145.156.168
Targets
-
-
Target
95abee4d159f541d81c84f6eb33a9bba7b5d1d7293e89857390b15498e138e51
-
Size
1.1MB
-
MD5
fe9946e628607b7d1f5b975bdd863000
-
SHA1
91fec6fb060ecb82fad71200cd75d11c8a610e40
-
SHA256
95abee4d159f541d81c84f6eb33a9bba7b5d1d7293e89857390b15498e138e51
-
SHA512
8882ef3f7629dd0372e4d03f9098c323544f7e38758ccccb0e66e3f3bccf8b90e4672a76a606c5938603d9190899894916975b1ca3ba0eaa067ed57968f682cc
-
Danabot x86 payload
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-