General
-
Target
45b7f38590ff124796e88223b0fa806f7eff1284e039fcc782cf89f76711bbc6
-
Size
2.1MB
-
Sample
220707-m5tnmaeccn
-
MD5
e0f0d97322dcaf7e450eb937ae4239ac
-
SHA1
e7ba66425d2105ccf74cdea9b967828616988257
-
SHA256
45b7f38590ff124796e88223b0fa806f7eff1284e039fcc782cf89f76711bbc6
-
SHA512
63e74a2ca41200a7549266649b9f9e25bf1b6ef5d379dd22229da256973c747a54d5ae046d60b154e518d5e71bce4febf35cd08cbadec487b5cf1731769ef991
Static task
static1
Behavioral task
behavioral1
Sample
CRA_INV_2019_971492629570/CRA_INV_2019_971492629570.vbs
Resource
win7-20220414-en
Malware Config
Extracted
danabot
181.63.44.194
207.148.83.108
45.77.40.71
87.115.138.169
24.229.48.7
116.111.206.27
45.196.143.203
218.65.3.199
131.59.110.186
113.81.97.96
Targets
-
-
Target
CRA_INV_2019_971492629570/CRA_INV_2019_971492629570.vbs
-
Size
24.3MB
-
MD5
350e751bb68ade139e174d65008eebe0
-
SHA1
f235f388686573edd1475f337c9b5b34afd4b9e1
-
SHA256
d39e3c62fb0b70846240f3d73a3885d5024eebcc9e61fa77f5ebbb450fbf7620
-
SHA512
3b34c36fd8e2e9b83150cfe652bc34c615b0017174f35d4ba2513d63b73aa51ae75c928f7e6307bd29d9adeb3222cb6ba8f19c0feeab53d2cf2f66ca43394f47
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Loads dropped DLL
-