Overview

overview

10

Static

static

10

Worm.Win32...a6.dll

windows7-x64

10

Worm.Win32...a6.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Worm.Win32.Ngrbot.buvj-12067132490a2ba849efa6.dll

  • Size

    1.3MB

  • Sample

    221230-tj34habb7s

  • MD5

    3d28307ea99a1c0266356e1eadbd0e51

  • SHA1

    f02d7d39bbac8f71a0f4575a42dcf3001cd3baa4

  • SHA256

    12067132490a2ba849efa610c68bad9f411bb92d5e2594737f8922e650be5fda

  • SHA512

    c861a989563a1a98cbb16d0c7c867d76563195d82afd03c6c8208e1e75756231e6f9073d90923513b83dcf6660c5edcd9a0f387c933092e0eba822ffa887e8b1

  • SSDEEP

    24576:O8FPicUZ6n4mAsAT4cYazgwzri7eGTtk5m:F+qaVHi7eGT65

Score
10/10
danabot4bankertrojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

192.236.161.79:443

37.220.31.27:443
Attributes
  • embedded_hash

    7FF0AA10AB3BA961670646D23EAE3911

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      Worm.Win32.Ngrbot.buvj-12067132490a2ba849efa6.dll

    • Size

      1.3MB

    • MD5

      3d28307ea99a1c0266356e1eadbd0e51

    • SHA1

      f02d7d39bbac8f71a0f4575a42dcf3001cd3baa4

    • SHA256

      12067132490a2ba849efa610c68bad9f411bb92d5e2594737f8922e650be5fda

    • SHA512

      c861a989563a1a98cbb16d0c7c867d76563195d82afd03c6c8208e1e75756231e6f9073d90923513b83dcf6660c5edcd9a0f387c933092e0eba822ffa887e8b1

    • SSDEEP

      24576:O8FPicUZ6n4mAsAT4cYazgwzri7eGTtk5m:F+qaVHi7eGT65

    Score
    10/10
    danabot4bankertrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot Loader Component

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks