Overview

overview

10

Static

static

117a69e016...57.exe

windows7-x64

10

117a69e016...57.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757

  • Size

    1.1MB

  • Sample

    221010-jna86sbcel

  • MD5

    7daa0221894d61fcac662545eaa09629

  • SHA1

    70bd1d9222b030c220ccc00c969afdeb32d61dba

  • SHA256

    117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757

  • SHA512

    11e5c32d9b88be211ed6fff30e65512259997cb3b65ce8f13f478f8f6e6d82a6b58ad7925eb9c0d5f8a2974e6bcfe2ca3b214c6b75094fb250d6266b2db3c40e

  • SSDEEP

    24576:YXXSiy1vaKFhT+FCtZzomoagvnGhQvPT68B2MEBJ:wSiwaiyFYKmoTnG2PTtB293

Score
10/10
danabot4bankertrojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

192.119.110.244:443

108.170.20.90:443

142.11.206.50:443
Attributes
  • embedded_hash

    6AD9FE4F9E491E785665E0D144F61DAB

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757

    • Size

      1.1MB

    • MD5

      7daa0221894d61fcac662545eaa09629

    • SHA1

      70bd1d9222b030c220ccc00c969afdeb32d61dba

    • SHA256

      117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757

    • SHA512

      11e5c32d9b88be211ed6fff30e65512259997cb3b65ce8f13f478f8f6e6d82a6b58ad7925eb9c0d5f8a2974e6bcfe2ca3b214c6b75094fb250d6266b2db3c40e

    • SSDEEP

      24576:YXXSiy1vaKFhT+FCtZzomoagvnGhQvPT68B2MEBJ:wSiwaiyFYKmoTnG2PTtB293

    Score
    10/10
    danabot4bankertrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot Loader Component

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks