General

  • Target

    97c6fcd944c08c8e704360bbc7942c93

  • Size

    1.1MB

  • Sample

    231227-abj6wahhb9

  • MD5

    97c6fcd944c08c8e704360bbc7942c93

  • SHA1

    ca9485348c17a422c175759c640999246aa2548d

  • SHA256

    686ae3c38a2f42c883eb8aa7b51dc99fb371b94a7bb7701737c9025231e1d503

  • SHA512

    5d8e565c4f0127cfda0878aa1c1b6327df3a359ce38c7c632561258cd2bef22103ddb204270bd29c1cffbd3d7ba31cd97e91abf502b32a27887d80273da6c629

  • SSDEEP

    24576:NcUMZzHq9a2jUWAs85Z6ovaPg62NKKGPbgyVx7WxS25C0jN:UzK9Rcs8k/8KDTgyVVWxS251N

Score
10/10

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.244.124:443

142.11.206.50:443

Attributes
  • embedded_hash

    6AD9FE4F9E491E785665E0D144F61DAB

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      97c6fcd944c08c8e704360bbc7942c93

    • Size

      1.1MB

    • MD5

      97c6fcd944c08c8e704360bbc7942c93

    • SHA1

      ca9485348c17a422c175759c640999246aa2548d

    • SHA256

      686ae3c38a2f42c883eb8aa7b51dc99fb371b94a7bb7701737c9025231e1d503

    • SHA512

      5d8e565c4f0127cfda0878aa1c1b6327df3a359ce38c7c632561258cd2bef22103ddb204270bd29c1cffbd3d7ba31cd97e91abf502b32a27887d80273da6c629

    • SSDEEP

      24576:NcUMZzHq9a2jUWAs85Z6ovaPg62NKKGPbgyVx7WxS25C0jN:UzK9Rcs8k/8KDTgyVVWxS251N

    Score
    10/10
    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Danabot Loader Component

    • Blocklisted process makes network request

    • Loads dropped DLL

MITRE ATT&CK Matrix

Tasks