Overview

overview

10

Static

static

0019389_01039.js

windows7-x64

10

0019389_01039.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aeee1398d6f05c673e07ecc3ab860cd2463f1d0d0ed1d331483fe135d4a40a9b

  • Size

    176KB

  • Sample

    221204-scqn6aaa77

  • MD5

    7732be3f15eea7357b2b7a2116fc7194

  • SHA1

    4dd03e5ca9971dd1458b11b49ec4ccaa97bb5c8a

  • SHA256

    aeee1398d6f05c673e07ecc3ab860cd2463f1d0d0ed1d331483fe135d4a40a9b

  • SHA512

    a9c1bb83a76e3a5b5874e0fb75b8b1732ebc1e84eacac5fcefabbf8e69c575d3ada7e473e66843a52028f02d68bdefba808ec7e3012196dc47258a3ef0717410

  • SSDEEP

    3072:9q0FKdnX2lDyFuty2jmYmrhBKAKuACUWCKImhkeQoLRwcoq9pc37qQleadc:U0YaDyYA4mYmtwuV/VhcYwcoEa3tsaO

Score
10/10
danabotbankerbotnettrojan

Malware Config

Extracted

Family

danabot

C2

164.175.70.152

89.144.25.243

86.177.194.155

29.195.96.191

29.43.1.29

84.215.94.117

115.58.63.174

89.144.25.104

199.179.34.46

68.48.87.153
rsa_pubkey.plain

Targets

    • Target

      0019389_01039.js

    • Size

      1.0MB

    • MD5

      d115552252592f589e7412d6650a949e

    • SHA1

      ad4c6cd7e85541866f5cd0fa747b7f08a5fe8067

    • SHA256

      3b55010b7f8f4e7ded435b29af5d00f98c06dd8f14258355d0049f186f4a6bbc

    • SHA512

      461aebb7a488102e3de0c9b807dbf8d04a41737d050dc4ca95bbf8283ee5176845adafee6bf81db83a73af2b67e66f45adaad6a145062ae035208cee71adfa71

    • SSDEEP

      1536:toTXaFN5VEYPznC2x1ZQu56WD/EYc9piGqvzlY84fEgZt32a2zO70tsE+TXURbtj:tS2uXtlk

    Score
    10/10
    danabotbankerbotnettrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot x86 payload

      Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

      botnet

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks