Overview

overview

10

Static

static

f54e72ec43...f6.exe

windows7-x64

10

f54e72ec43...f6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f54e72ec43ba9b6d7dcb039cc2ad48f6.exe

  • Size

    1.1MB

  • Sample

    221220-lxskxscd2v

  • MD5

    f54e72ec43ba9b6d7dcb039cc2ad48f6

  • SHA1

    4dd3e8194b67d5e594eee18101bee38a69d1343a

  • SHA256

    106a8c05bd4fe5807019f19c99c66dd65166442148ab41a482944a06740dca2f

  • SHA512

    50e425e51b2fe3a11e35499470c0cb9e571f82a1beff6acf21a061da53f278de362a7dd93b121408cf7a27421ff2a557e59c94943f9b3681dab7e023b64c7c3e

  • SSDEEP

    24576:T8Wm0i8kSft6kipJYRYWvFZS1LVb1wkOGM9MiALQ2wFP:PGhSEvARYSZSxBBOxJAQhFP

Score
10/10
danabotbankerdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      f54e72ec43ba9b6d7dcb039cc2ad48f6.exe

    • Size

      1.1MB

    • MD5

      f54e72ec43ba9b6d7dcb039cc2ad48f6

    • SHA1

      4dd3e8194b67d5e594eee18101bee38a69d1343a

    • SHA256

      106a8c05bd4fe5807019f19c99c66dd65166442148ab41a482944a06740dca2f

    • SHA512

      50e425e51b2fe3a11e35499470c0cb9e571f82a1beff6acf21a061da53f278de362a7dd93b121408cf7a27421ff2a557e59c94943f9b3681dab7e023b64c7c3e

    • SSDEEP

      24576:T8Wm0i8kSft6kipJYRYWvFZS1LVb1wkOGM9MiALQ2wFP:PGhSEvARYSZSxBBOxJAQhFP

    Score
    10/10
    danabotbankerdiscoverypersistencetrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Blocklisted process makes network request

    • Sets DLL path for service in the registry

      persistence

    • Sets service image path in registry

      persistence

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks