danabot | 7cfb016588c51d6ce75aeda0afcf0e5f979cdcaa59b2ecc07d488f1a5f6180d4 | Triage

Sharing

General

Target

7cfb016588c51d6ce75aeda0afcf0e5f979cdcaa59b2ecc07d488f1a5f6180d4
Size

128KB
Sample

220926-vprs4acehk
MD5

bedc12f0bf88584c2dc4a9e9bb3b4a76
SHA1

a822940d174f6c4dcb5443337aa374a9a7c538a4
SHA256

7cfb016588c51d6ce75aeda0afcf0e5f979cdcaa59b2ecc07d488f1a5f6180d4
SHA512

850981cf6494bd4d0a858d712ababa6c9636a5a36998fb11e193677a3eafc36dd9f6f6eb9c7bd1e78f5e50a9be928b20f31f4e338e3b2401deed55fcb3156896
SSDEEP

3072:7Lh5Tc55KZjE5RXOEqmGBS5PTMrHBQq3d5B:cKZ45RX7B5PwrhZ

Score

10^/10

danabot redline insmix banker discovery infostealer spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

insmix

C2

jamesmillion2.xyz:9420

Attributes

auth_value
f388a05524f756108c9e4b0f4c4bafb6

Extracted

Family

danabot

C2

198.15.112.179:443

185.62.56.245:443

153.92.223.225:443

192.119.70.159:443

Attributes

embedded_hash
6618C163D57D6441FCCA65D86C4D380D
type
loader

Targets

- Target
  
  7cfb016588c51d6ce75aeda0afcf0e5f979cdcaa59b2ecc07d488f1a5f6180d4
- Size
  
  128KB
- MD5
  
  bedc12f0bf88584c2dc4a9e9bb3b4a76
- SHA1
  
  a822940d174f6c4dcb5443337aa374a9a7c538a4
- SHA256
  
  7cfb016588c51d6ce75aeda0afcf0e5f979cdcaa59b2ecc07d488f1a5f6180d4
- SHA512
  
  850981cf6494bd4d0a858d712ababa6c9636a5a36998fb11e193677a3eafc36dd9f6f6eb9c7bd1e78f5e50a9be928b20f31f4e338e3b2401deed55fcb3156896
- SSDEEP
  
  3072:7Lh5Tc55KZjE5RXOEqmGBS5PTMrHBQq3d5B:cKZ45RX7B5PwrhZ
Score

10^/10

danabot redline insmix banker discovery infostealer spyware stealer trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Downloads MZ/PE file
- Executes dropped EXE
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

danabotredlineinsmixbankerdiscoveryinfostealerspywarestealertrojan