General
-
Target
C88E21014F321E99295005388B9016DB.bin
-
Size
2.6MB
-
Sample
220709-jnyz8schgj
-
MD5
a114d7b1a54be867c02afced9031fb36
-
SHA1
5d1085a73bcb42afbe71c298ad0d2b0b304d5b2b
-
SHA256
68027593e9c91fe4f0e1412ed861dcd1d70b4bf1e101d907fd32d58fa95d3c04
-
SHA512
1fb96b51340e619ab2f62f3a2b2d009061198a7b300292363dedfa91ea58fc18929d33510e3648f3c78f69b8dfa5b1af66677cb352fdaa1ffc50f8403c0f389a
Static task
static1
Behavioral task
behavioral1
Sample
C88E21014F321E99295005388B9016DB.dll
Resource
win7-20220414-en
Malware Config
Extracted
danabot
100.0.0.0:5148
58.50.42.34:13886
26.18.10.2:5662
60.52.44.36:14400
-
embedded_hash
zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
-
type
loader
Targets
-
-
Target
C88E21014F321E99295005388B9016DB.bin
-
Size
2.6MB
-
MD5
a114d7b1a54be867c02afced9031fb36
-
SHA1
5d1085a73bcb42afbe71c298ad0d2b0b304d5b2b
-
SHA256
68027593e9c91fe4f0e1412ed861dcd1d70b4bf1e101d907fd32d58fa95d3c04
-
SHA512
1fb96b51340e619ab2f62f3a2b2d009061198a7b300292363dedfa91ea58fc18929d33510e3648f3c78f69b8dfa5b1af66677cb352fdaa1ffc50f8403c0f389a
-
Blocklisted process makes network request
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-
Suspicious use of SetThreadContext
-