Overview

overview

10

Static

static

3

0e320557c1...5e.exe

windows7-x64

10

0e320557c1...5e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0e320557c1eec1fdc59223f4bf2d3e5e

  • Size

    1.0MB

  • Sample

    231230-ew2zmsbchl

  • MD5

    0e320557c1eec1fdc59223f4bf2d3e5e

  • SHA1

    50f5c455c19d9488d8a7b927348978e9350d5897

  • SHA256

    6abb3cc19d6f88bf35d506d10ee0c82cee7b5eebef4cbef70857cde8cd572894

  • SHA512

    90a9e8c4dacda35e485dd47ea26de218dc47194f95ec9d4f441011e1970afb5021448c0aecb50e11c0f2617077fead79907a137447905bafc5983de517a8526c

  • SSDEEP

    24576:zZ/v969WPODNO3/J/d03mGBPPCVW1XYyRPQtm1:zZs3ypS3mGBPPC2oyEi

Score
10/10
danabot5bankertrojan

Malware Config

Extracted

Family

danabot

Botnet

5

C2

192.210.222.81:443

23.229.29.48:443

5.9.224.204:443

192.255.166.212:443
Attributes
  • embedded_hash

    100700D372965A717E89B8C909E1D8D4

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      0e320557c1eec1fdc59223f4bf2d3e5e

    • Size

      1.0MB

    • MD5

      0e320557c1eec1fdc59223f4bf2d3e5e

    • SHA1

      50f5c455c19d9488d8a7b927348978e9350d5897

    • SHA256

      6abb3cc19d6f88bf35d506d10ee0c82cee7b5eebef4cbef70857cde8cd572894

    • SHA512

      90a9e8c4dacda35e485dd47ea26de218dc47194f95ec9d4f441011e1970afb5021448c0aecb50e11c0f2617077fead79907a137447905bafc5983de517a8526c

    • SSDEEP

      24576:zZ/v969WPODNO3/J/d03mGBPPCVW1XYyRPQtm1:zZs3ypS3mGBPPC2oyEi

    Score
    10/10
    danabot5bankertrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot Loader Component

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks