General

  • Target

    f294c0aaa7dd08afc72022371016b50a5e5fd0903f742490c7e0a6f01265c270

  • Size

    258KB

  • Sample

    220929-z4ybmscac4

  • MD5

    3a896487767174953da01d4f15bfdac6

  • SHA1

    1a201d58e82fd1f08af423413a88d0161891a43d

  • SHA256

    f294c0aaa7dd08afc72022371016b50a5e5fd0903f742490c7e0a6f01265c270

  • SHA512

    389f48b6bf9fd09f78f8148329433554bfd5e9618faf18f20ab698b239b271b06e445a50f33575bd5f3687420922fc625e560c566c77817cc68744e3e0ffae49

  • SSDEEP

    3072:/hRXhs9WwnC/0fuIZTsnEZ5OrX7q1j/QufcIP5uqP0qOjBPVWrxpzbgqruO0KTza:/D0nC/ugv8TX30jjFVuzbgwuO0+Yc7R

Score
10/10

Malware Config

Extracted

Family

danabot

C2

192.236.233.188:443

23.106.124.171:443

192.119.70.159:443

Attributes
  • embedded_hash

    A813CAF845B5703DA814AF785BB60B21

  • type

    loader

Targets

    • Target

      f294c0aaa7dd08afc72022371016b50a5e5fd0903f742490c7e0a6f01265c270

    • Size

      258KB

    • MD5

      3a896487767174953da01d4f15bfdac6

    • SHA1

      1a201d58e82fd1f08af423413a88d0161891a43d

    • SHA256

      f294c0aaa7dd08afc72022371016b50a5e5fd0903f742490c7e0a6f01265c270

    • SHA512

      389f48b6bf9fd09f78f8148329433554bfd5e9618faf18f20ab698b239b271b06e445a50f33575bd5f3687420922fc625e560c566c77817cc68744e3e0ffae49

    • SSDEEP

      3072:/hRXhs9WwnC/0fuIZTsnEZ5OrX7q1j/QufcIP5uqP0qOjBPVWrxpzbgqruO0KTza:/D0nC/ugv8TX30jjFVuzbgwuO0+Yc7R

    Score
    10/10
    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Deletes itself

MITRE ATT&CK Enterprise v6

Tasks