danabot | 3ccbbb509d71036566e412260c6a18809249014cbb58b70cd8051f9e4cdc896e | Triage

Sharing

General

Target

3ccbbb509d71036566e412260c6a18809249014cbb58b70cd8051f9e4cdc896e
Size

153KB
Sample

220926-km899abcfm
MD5

5cc74bf9d929fa3d5f87bc6134824b33
SHA1

12b6cdebc4111c5fe2354b6f950fb75f8371e635
SHA256

3ccbbb509d71036566e412260c6a18809249014cbb58b70cd8051f9e4cdc896e
SHA512

95363651b3de99699ddb3892d16d52cd3b369c7e0afd908db930a1365277f8fc49c64395a367c90b6cda3b922b5fc7912b99b9a38e5c9041f9a6a7547da67848
SSDEEP

3072:jdRao7CG5Z5q4SBpaDDCKhjdbBlklG8scu5x:C85/SBpavCG5vklps

Score

10^/10

danabot redline insmix banker discovery infostealer spyware stealer trojan

Malware Config

Extracted

Family

danabot

C2

198.15.112.179:443

185.62.56.245:443

153.92.223.225:443

192.119.70.159:443

Attributes

embedded_hash
6618C163D57D6441FCCA65D86C4D380D
type
loader

Extracted

Family

redline

Botnet

insmix

C2

jamesmillion2.xyz:9420

Attributes

auth_value
f388a05524f756108c9e4b0f4c4bafb6

Targets

- Target
  
  3ccbbb509d71036566e412260c6a18809249014cbb58b70cd8051f9e4cdc896e
- Size
  
  153KB
- MD5
  
  5cc74bf9d929fa3d5f87bc6134824b33
- SHA1
  
  12b6cdebc4111c5fe2354b6f950fb75f8371e635
- SHA256
  
  3ccbbb509d71036566e412260c6a18809249014cbb58b70cd8051f9e4cdc896e
- SHA512
  
  95363651b3de99699ddb3892d16d52cd3b369c7e0afd908db930a1365277f8fc49c64395a367c90b6cda3b922b5fc7912b99b9a38e5c9041f9a6a7547da67848
- SSDEEP
  
  3072:jdRao7CG5Z5q4SBpaDDCKhjdbBlklG8scu5x:C85/SBpavCG5vklps
Score

10^/10

danabot redline insmix banker discovery infostealer spyware stealer trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Downloads MZ/PE file
- Executes dropped EXE
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

danabotredlineinsmixbankerdiscoveryinfostealerspywarestealertrojan