General

  • Target

    68a6707917bb90040755111aa42b5054

  • Size

    1.1MB

  • Sample

    231226-mwxzpahhg2

  • MD5

    68a6707917bb90040755111aa42b5054

  • SHA1

    106c9280bf1a309de30e203e28d4e8d51f478d84

  • SHA256

    87d81ffeb04f8d1d4107c7c870fb3f52b4540f9e61addbedc920cabd81dd82b7

  • SHA512

    5992a58b39b0ce1ee42f4d15b582ffe488c8b58f8df00dd9053610f2a3cf03610025652bb8fd8559ed94d9931c4c63775615cebf87096adc2e8b78a8d26a7bcc

  • SSDEEP

    24576:GyOjo7TdoacVRj2ZpVzT1h7WFPsxipZzabkns9ezUgD6Chr:JeVtEnTcvzaHGH7

Score
10/10

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.244.124:443

142.11.206.50:443

Attributes
  • embedded_hash

    6AD9FE4F9E491E785665E0D144F61DAB

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      68a6707917bb90040755111aa42b5054

    • Size

      1.1MB

    • MD5

      68a6707917bb90040755111aa42b5054

    • SHA1

      106c9280bf1a309de30e203e28d4e8d51f478d84

    • SHA256

      87d81ffeb04f8d1d4107c7c870fb3f52b4540f9e61addbedc920cabd81dd82b7

    • SHA512

      5992a58b39b0ce1ee42f4d15b582ffe488c8b58f8df00dd9053610f2a3cf03610025652bb8fd8559ed94d9931c4c63775615cebf87096adc2e8b78a8d26a7bcc

    • SSDEEP

      24576:GyOjo7TdoacVRj2ZpVzT1h7WFPsxipZzabkns9ezUgD6Chr:JeVtEnTcvzaHGH7

    Score
    10/10
    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Danabot Loader Component

    • Blocklisted process makes network request

    • Loads dropped DLL

MITRE ATT&CK Matrix

Tasks