General

  • Target

    313f8ea3e5d6147cbbfa44dd428b442f

  • Size

    1.3MB

  • Sample

    231222-afmgssgbg6

  • MD5

    313f8ea3e5d6147cbbfa44dd428b442f

  • SHA1

    c575ae245b3145a681cd4b73da04f7f102e01a3c

  • SHA256

    6f5f6fb6434f593f40293503c6b2511e0402334e017db5666a93a78d7bd70d85

  • SHA512

    aaf0700866604c2dcc5e93147b7600863290db9755da2cf41baa82dd542b2091218bf5418b2bb5c8e176a993d9086887797f1158188c4c51e4b8af9f83bfd02f

  • SSDEEP

    24576:RcF2gkC9VOffE9aU9C1r35rrtVfC2MWQzfIiI4tbeTb20:Sg1VfCQn4ReTt

Score
10/10

Malware Config

Extracted

Family

danabot

Botnet

4

C2

23.229.29.48:443

5.9.224.204:443

192.210.222.81:443

Attributes
  • embedded_hash

    0E1A7A1479C37094441FA911262B322A

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      313f8ea3e5d6147cbbfa44dd428b442f

    • Size

      1.3MB

    • MD5

      313f8ea3e5d6147cbbfa44dd428b442f

    • SHA1

      c575ae245b3145a681cd4b73da04f7f102e01a3c

    • SHA256

      6f5f6fb6434f593f40293503c6b2511e0402334e017db5666a93a78d7bd70d85

    • SHA512

      aaf0700866604c2dcc5e93147b7600863290db9755da2cf41baa82dd542b2091218bf5418b2bb5c8e176a993d9086887797f1158188c4c51e4b8af9f83bfd02f

    • SSDEEP

      24576:RcF2gkC9VOffE9aU9C1r35rrtVfC2MWQzfIiI4tbeTb20:Sg1VfCQn4ReTt

    Score
    10/10
    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Danabot Loader Component

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks