Overview

overview

10

Static

static

10

Trojan-Ban...a3.dll

windows7-x64

10

Trojan-Ban...a3.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Trojan-Banker.Win32.Danabot.jqm-a835d0a363da3.dll

  • Size

    1.3MB

  • Sample

    230604-m4hvqsce6t

  • MD5

    e19fc2c2485093be5db8883bd76c5b1b

  • SHA1

    08108bc08bc7c367784a9690c88fe604c8bddd99

  • SHA256

    a835d0a363da3392795acfd5a23004c04e9014b5eea42bb65c1564803514e62c

  • SHA512

    6224205bd61d33c9f1b414077e8180afd3a947a41908936838e240aa4481b3f53e8bc73ce2edf793114fc5fd49b3cac04a051221cb7b8416013d10718f3eaf3e

  • SSDEEP

    24576:V8FG6VuIFaXYLPt2vPUzE29sZK2iGTiaPV:2bL9stTL

Score
10/10
danabot2bankertrojan

Malware Config

Extracted

Family

danabot

Botnet

2

C2

213.252.245.80:443

Attributes
  • embedded_hash

    8094BFF39A6D716FA4E467944C4F1056

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      Trojan-Banker.Win32.Danabot.jqm-a835d0a363da3.dll

    • Size

      1.3MB

    • MD5

      e19fc2c2485093be5db8883bd76c5b1b

    • SHA1

      08108bc08bc7c367784a9690c88fe604c8bddd99

    • SHA256

      a835d0a363da3392795acfd5a23004c04e9014b5eea42bb65c1564803514e62c

    • SHA512

      6224205bd61d33c9f1b414077e8180afd3a947a41908936838e240aa4481b3f53e8bc73ce2edf793114fc5fd49b3cac04a051221cb7b8416013d10718f3eaf3e

    • SSDEEP

      24576:V8FG6VuIFaXYLPt2vPUzE29sZK2iGTiaPV:2bL9stTL

    Score
    10/10
    danabot2bankertrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot Loader Component

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks