Overview

overview

10

Static

static

10

91E7C5079D...25.dll

windows7_x64

10

91E7C5079D...25.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    91E7C5079D763E383AEB9CCB9D9247B3FA9B7BCBB9B25.dll

  • Size

    1.2MB

  • Sample

    220704-y145caahgq

  • MD5

    5bed077686d02a875e6cf3fa41522db2

  • SHA1

    cadeecb51c6f1e63e8fdcaf6604256e6d6965a86

  • SHA256

    91e7c5079d763e383aeb9ccb9d9247b3fa9b7bcbb9b2585eea4188a87b858bc5

  • SHA512

    6503da49ad92d6fed4836e2d9ef7eb5c0d9756d77efb1c62622393ca8a9979dc4fdd7ee14ef92d15976a66b3265e4163d58dd0bc59720eee14bdfeab613e794f

Score
10/10
danabot4bankersuricatatrojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

37.220.31.27:443

66.85.185.120:443
Attributes
  • embedded_hash

    0B67BD22E198660FB459B076DE202D09

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      91E7C5079D763E383AEB9CCB9D9247B3FA9B7BCBB9B25.dll

    • Size

      1.2MB

    • MD5

      5bed077686d02a875e6cf3fa41522db2

    • SHA1

      cadeecb51c6f1e63e8fdcaf6604256e6d6965a86

    • SHA256

      91e7c5079d763e383aeb9ccb9d9247b3fa9b7bcbb9b2585eea4188a87b858bc5

    • SHA512

      6503da49ad92d6fed4836e2d9ef7eb5c0d9756d77efb1c62622393ca8a9979dc4fdd7ee14ef92d15976a66b3265e4163d58dd0bc59720eee14bdfeab613e794f

    Score
    10/10
    danabot4bankersuricatatrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot Loader Component

    • suricata: ET MALWARE Danabot Key Exchange Request

      suricata: ET MALWARE Danabot Key Exchange Request

      suricata

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks