danabot | 4df55b42235a2e1eb11e79693bfd44141c219687a30a61544e29a9ddf7ff3e87 | Triage

Sharing

General

Target

4df55b42235a2e1eb11e79693bfd44141c219687a30a61544e29a9ddf7ff3e87
Size

1.3MB
Sample

231113-lrcbracd66
MD5

fa6532e4686be74bedebb4c0eaafe5fe
SHA1

19874a6b0cfacfb9ab910a718d1dbaeff21c3726
SHA256

4df55b42235a2e1eb11e79693bfd44141c219687a30a61544e29a9ddf7ff3e87
SHA512

5bfcf0f3ad2141139994e08d87b66f5a998dddaf0017ba512b0dac748fdc7d8d65c62a428ae631fa9dd4fbe584e249b3337c84ad558dd8a927f490ba33593948
SSDEEP

24576:qcFXBjis24E0ykpDOxlEtesuSibHsVS+kVLTQPTBWcys:RD2JKtesQbHd+gT2BWPs

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

192.236.161.79:443

192.236.146.39:443

37.220.31.27:443

Attributes

embedded_hash
7FF0AA10AB3BA961670646D23EAE3911
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Targets

- Target
  
  4df55b42235a2e1eb11e79693bfd44141c219687a30a61544e29a9ddf7ff3e87
- Size
  
  1.3MB
- MD5
  
  fa6532e4686be74bedebb4c0eaafe5fe
- SHA1
  
  19874a6b0cfacfb9ab910a718d1dbaeff21c3726
- SHA256
  
  4df55b42235a2e1eb11e79693bfd44141c219687a30a61544e29a9ddf7ff3e87
- SHA512
  
  5bfcf0f3ad2141139994e08d87b66f5a998dddaf0017ba512b0dac748fdc7d8d65c62a428ae631fa9dd4fbe584e249b3337c84ad558dd8a927f490ba33593948
- SSDEEP
  
  24576:qcFXBjis24E0ykpDOxlEtesuSibHsVS+kVLTQPTBWcys:RD2JKtesQbHd+gT2BWPs
Score

10^/10

danabot 4 banker trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Blocklisted process makes network request
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

danabot4bankertrojan

behavioral2

danabot4bankertrojan