danabot

General

Target

bc1c19fb9559d3e0f6ede05232c6f72d8306f8858f740bf9a8dd768c0cba92de
Size

153KB
Sample

220926-qes6ysahb6
MD5

7d53fa419ac8d29b79078ca0c4bb85c6
SHA1

e051e6cf509d78cad4337ee84b1f4ffaa0c3ac8b
SHA256

bc1c19fb9559d3e0f6ede05232c6f72d8306f8858f740bf9a8dd768c0cba92de
SHA512

9232370c1f86cfae4c67b545c3a61374381d67bfa97ca64ee0bb9bc4b53f9de3c33ef0fcef012998fdde482c0ab5a7e52a55d0d32787c44a9f388a294929ce53
SSDEEP

1536:VTcMoYs1izSP44tTF5YuMdb47ZPaEF1J3IcP9WlY9aRFucLyOGgxjYj1Ei/UunL2:VTSzTF5eb079pUx3TylgGBtJ+/aK5B

Score

10^/10

Malware Config

Extracted

Family

danabot

C2

198.15.112.179:443

185.62.56.245:443

153.92.223.225:443

192.119.70.159:443

Attributes

embedded_hash
6618C163D57D6441FCCA65D86C4D380D
type
loader

Extracted

Family

redline

Botnet

insmix

C2

jamesmillion2.xyz:9420

Attributes

auth_value
f388a05524f756108c9e4b0f4c4bafb6

Extracted

Family

systembc

C2

141.98.82.229:4001

Targets

- Target
  
  bc1c19fb9559d3e0f6ede05232c6f72d8306f8858f740bf9a8dd768c0cba92de
- Size
  
  153KB
- MD5
  
  7d53fa419ac8d29b79078ca0c4bb85c6
- SHA1
  
  e051e6cf509d78cad4337ee84b1f4ffaa0c3ac8b
- SHA256
  
  bc1c19fb9559d3e0f6ede05232c6f72d8306f8858f740bf9a8dd768c0cba92de
- SHA512
  
  9232370c1f86cfae4c67b545c3a61374381d67bfa97ca64ee0bb9bc4b53f9de3c33ef0fcef012998fdde482c0ab5a7e52a55d0d32787c44a9f388a294929ce53
- SSDEEP
  
  1536:VTcMoYs1izSP44tTF5YuMdb47ZPaEF1J3IcP9WlY9aRFucLyOGgxjYj1Ei/UunL2:VTSzTF5eb079pUx3TylgGBtJ+/aK5B
Score

10^/10

danabot redline smokeloader systembc insmix backdoor banker discovery infostealer spyware stealer trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- SystemBC
  SystemBC is a proxy and remote administration tool first seen in 2019.
  trojan systembc
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1