danabot | c97ad75a7fa3587f8e25d3f2d0348ab40cbe059fa825d7d070bfd4e60ec0ebc5 | Triage

Sharing

General

Target

c97ad75a7fa3587f8e25d3f2d0348ab40cbe059fa825d7d070bfd4e60ec0ebc5
Size

1.3MB
Sample

231105-de8kesca37
MD5

edab8cea8ffcf471829be19fc8ec8a06
SHA1

cd6fbac9611f57216d2a174b7c58bb2c708e1607
SHA256

c97ad75a7fa3587f8e25d3f2d0348ab40cbe059fa825d7d070bfd4e60ec0ebc5
SHA512

70390d2e9689eaea9e6b27a3366938909cea10a41458c75c35c06aebced63051934991d1919801cf1e03c2ac66c35d0a6cb3cf7bd8005ffe91890986da767003
SSDEEP

24576:qcFXBjis24E0ykpDOxlEtesuSibHsVS+kVgTQPTBWcys:RD2JKtesQbHd+XT2BWPs

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

192.236.161.79:443

192.236.146.39:443

37.220.31.27:443

Attributes

embedded_hash
7FF0AA10AB3BA961670646D23EAE3911
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Targets

- Target
  
  c97ad75a7fa3587f8e25d3f2d0348ab40cbe059fa825d7d070bfd4e60ec0ebc5
- Size
  
  1.3MB
- MD5
  
  edab8cea8ffcf471829be19fc8ec8a06
- SHA1
  
  cd6fbac9611f57216d2a174b7c58bb2c708e1607
- SHA256
  
  c97ad75a7fa3587f8e25d3f2d0348ab40cbe059fa825d7d070bfd4e60ec0ebc5
- SHA512
  
  70390d2e9689eaea9e6b27a3366938909cea10a41458c75c35c06aebced63051934991d1919801cf1e03c2ac66c35d0a6cb3cf7bd8005ffe91890986da767003
- SSDEEP
  
  24576:qcFXBjis24E0ykpDOxlEtesuSibHsVS+kVgTQPTBWcys:RD2JKtesQbHd+XT2BWPs
Score

10^/10

danabot 4 banker trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Blocklisted process makes network request
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

danabot4bankertrojan

behavioral2

danabot4bankertrojan