General

  • Target

    96175cd7408ea54323b4f072ca0b8f3d3ba594abd3d1ddbd48281b5efbdc69cb

  • Size

    203KB

  • Sample

    221019-bq1ylsedb2

  • MD5

    6e2038660c197a2b0da37d12096a6e2e

  • SHA1

    cbb304fd4720cb894e953af23c151af7c9b9f3b6

  • SHA256

    96175cd7408ea54323b4f072ca0b8f3d3ba594abd3d1ddbd48281b5efbdc69cb

  • SHA512

    483d884bf5261c7f73dcc5957559312cf74833ba0c6846b6aa143a645dd221fbf76eb75d932cf05fdd0009daada06c3cfaa8b6d47af79e94893344d686921d9a

  • SSDEEP

    3072:uXOru/L8/cuC5Bh16E4jY7unH9BXHXVFoE0k3E0K0UCx8UuSC:2au/LcBYh13LuH99gE0k00b7uS

Score
10/10

Malware Config

Extracted

Family

danabot

C2

192.236.233.188:443

192.119.70.159:443

23.106.124.171:443

213.227.155.103:443

Attributes
  • embedded_hash

    56951C922035D696BFCE443750496462

  • type

    loader

Targets

    • Target

      96175cd7408ea54323b4f072ca0b8f3d3ba594abd3d1ddbd48281b5efbdc69cb

    • Size

      203KB

    • MD5

      6e2038660c197a2b0da37d12096a6e2e

    • SHA1

      cbb304fd4720cb894e953af23c151af7c9b9f3b6

    • SHA256

      96175cd7408ea54323b4f072ca0b8f3d3ba594abd3d1ddbd48281b5efbdc69cb

    • SHA512

      483d884bf5261c7f73dcc5957559312cf74833ba0c6846b6aa143a645dd221fbf76eb75d932cf05fdd0009daada06c3cfaa8b6d47af79e94893344d686921d9a

    • SSDEEP

      3072:uXOru/L8/cuC5Bh16E4jY7unH9BXHXVFoE0k3E0K0UCx8UuSC:2au/LcBYh13LuH99gE0k00b7uS

    Score
    10/10
    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Deletes itself

MITRE ATT&CK Enterprise v6

Tasks