Overview

overview

10

Static

static

Receipt#20...81.vbs

windows7-x64

10

Receipt#20...81.vbs

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a9aad49b71c95d7dfcd106e898620398abcae84f00d2256cf9f37d4cb0c09fc8

  • Size

    745KB

  • Sample

    221108-lx4cesafb7

  • MD5

    cd8d358bae29c732b00f52aa608f37ba

  • SHA1

    959f06bf985da2bf252f4a4fa6f6494c23840096

  • SHA256

    a9aad49b71c95d7dfcd106e898620398abcae84f00d2256cf9f37d4cb0c09fc8

  • SHA512

    1bb45512a24ec0ad8e432032e11ac7d4ae29c46e9c6d9e50660e90bf407c3d16c010b7e8819a118f06036a063c9a6d36f1df47d3615d1e4e4582999e399f43fc

  • SSDEEP

    12288:N8ED7fxTMHc51E1Uit7/n9OADFcXHmFADsPqoBF/YRgWRbOI23YtqSuyYL:GED7Nk4wPJ/9OApFAoVZYR5h2UqSuyy

Score
10/10
danabotbankerbotnettrojan

Malware Config

Extracted

Family

danabot

C2

214.117.153.178

254.72.43.217

150.116.120.176

199.21.37.100

46.168.211.8

175.16.177.89

17.31.87.118

95.179.168.37

117.111.1.23

207.148.83.108
rsa_pubkey.plain

Targets

    • Target

      Receipt#2019#d4f82296053ee0bc42239071f67abb981.vbs

    • Size

      4.9MB

    • MD5

      f3ed87b32b193290549208db85679ca6

    • SHA1

      ba83a0ec36bcf851b9a12bcaf545973f7499193c

    • SHA256

      4747f8d0515a3209e45ffdb4fe25cf62f8b5db48faff4357362c45d56e25db83

    • SHA512

      bcdcd1fa7b075d99ccb982ea81fef77fc6b51f10fd3e8f6be88f7abeb74f4f410d9752077233a71929520c4b9cd54c6ec770fb0e41ee178fd865252f446169e9

    • SSDEEP

      6144:c+cu121NcILqP+BG2O03uLV1J2wH6+uVPXuTyVETIXE8fZqChiX:cnqW5s2K6+iPXuTyVSIXE8hqCAX

    Score
    10/10
    danabotbankerbotnettrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot x86 payload

      Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

      botnet

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks