Overview

overview

10

Static

static

10

8de0331321...b1.exe

windows7-x64

10

8de0331321...b1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8de0331321f997f4ec2ab18ccf1854f1cbb721130584412f61eccc510b0dffb1

  • Size

    3.6MB

  • Sample

    221220-rv8f9aaa44

  • MD5

    47cd3545fdf1ad616dce8f5535a8a03f

  • SHA1

    6b48cbcfccfc4ae5546eb3a99e069ee1f6bd712f

  • SHA256

    8de0331321f997f4ec2ab18ccf1854f1cbb721130584412f61eccc510b0dffb1

  • SHA512

    e3b8e2d890148888783f085edc5ddf2f7931c65f20388da8295a0627738ce966d91d17145afc9428a09501850a796b0bd16c1e0220ca646fc556c6c9097b8c2d

  • SSDEEP

    49152:zjvWrU4VyUHA3iRYoySMbSsigAh14tKS2lw4I0LGAEwxQGV3O:3wU4VyUHpRYoESsigAlyJ

Score
10/10
danabotbankerdiscoverypersistencetrojan

Malware Config

Extracted

Family

danabot

C2

23.236.181.126:443

123.253.35.251:443

66.85.173.3:443
Attributes
  • embedded_hash

    8F56CD73F6B5CD5D7B17B0BA61E70A82

  • type

    loader

Targets

    • Target

      8de0331321f997f4ec2ab18ccf1854f1cbb721130584412f61eccc510b0dffb1

    • Size

      3.6MB

    • MD5

      47cd3545fdf1ad616dce8f5535a8a03f

    • SHA1

      6b48cbcfccfc4ae5546eb3a99e069ee1f6bd712f

    • SHA256

      8de0331321f997f4ec2ab18ccf1854f1cbb721130584412f61eccc510b0dffb1

    • SHA512

      e3b8e2d890148888783f085edc5ddf2f7931c65f20388da8295a0627738ce966d91d17145afc9428a09501850a796b0bd16c1e0220ca646fc556c6c9097b8c2d

    • SSDEEP

      49152:zjvWrU4VyUHA3iRYoySMbSsigAh14tKS2lw4I0LGAEwxQGV3O:3wU4VyUHpRYoESsigAlyJ

    Score
    10/10
    danabotbankerdiscoverypersistencetrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Blocklisted process makes network request

    • Sets DLL path for service in the registry

      persistence

    • Sets service image path in registry

      persistence

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks