General
-
Target
385d503f8dd71d2a94d5e0b4d72fdf001d5eb419e20670a78925102f3238ae03
-
Size
2.1MB
-
Sample
220625-y2c29aaegj
-
MD5
cb3066ab7b917ec0b0b48d59a67a1908
-
SHA1
9fb9c672d4bc3837cac71d9e17466067e310fab7
-
SHA256
385d503f8dd71d2a94d5e0b4d72fdf001d5eb419e20670a78925102f3238ae03
-
SHA512
1f619141d98b866e8f3e179ec9bf72ff4f00d795a3d3a86c32a514351efc03b3518a174e75f4a4703037da83bed6ab0ee134cf2fb15527efe10366cef3613951
Static task
static1
Behavioral task
behavioral1
Sample
CRA_INV_2019_633192078733/CRA_INV_2019_633192078733.vbs
Resource
win7-20220414-en
Malware Config
Extracted
danabot
181.63.44.194
207.148.83.108
45.77.40.71
87.115.138.169
24.229.48.7
116.111.206.27
45.196.143.203
218.65.3.199
131.59.110.186
113.81.97.96
Targets
-
-
Target
CRA_INV_2019_633192078733/CRA_INV_2019_633192078733.vbs
-
Size
24.3MB
-
MD5
350e751bb68ade139e174d65008eebe0
-
SHA1
f235f388686573edd1475f337c9b5b34afd4b9e1
-
SHA256
d39e3c62fb0b70846240f3d73a3885d5024eebcc9e61fa77f5ebbb450fbf7620
-
SHA512
3b34c36fd8e2e9b83150cfe652bc34c615b0017174f35d4ba2513d63b73aa51ae75c928f7e6307bd29d9adeb3222cb6ba8f19c0feeab53d2cf2f66ca43394f47
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Loads dropped DLL
-