General

  • Target

    1aa3d37a959b274f1e8960db369a1971

  • Size

    1.3MB

  • Sample

    231230-q6wfdsfag5

  • MD5

    1aa3d37a959b274f1e8960db369a1971

  • SHA1

    e9b5cb6ba9f54d1594cec043c469d5f46208df07

  • SHA256

    05b1f6d34238696d522cb7519a113abdbd74dfd2b32b43fa0709b6dd5ed57e64

  • SHA512

    bd4af60fd58abe00da32228e0dfe63cf203af14c8af2732cd708907ecc1d14a191dd78af5843fca9c5f393d4e4619b4f69b200225e15211a51eb7bbf1dca45ea

  • SSDEEP

    24576:RcF2ddLBEH/yuGeb3+yPbduheDDx0OJ13TPWi+D:SQ3yhugD7Tu5D

Score
10/10

Malware Config

Extracted

Family

danabot

Botnet

4

C2

104.168.148.6:443

5.9.224.204:443

192.210.222.81:443

23.229.29.48:443

Attributes
  • embedded_hash

    0E1A7A1479C37094441FA911262B322A

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      1aa3d37a959b274f1e8960db369a1971

    • Size

      1.3MB

    • MD5

      1aa3d37a959b274f1e8960db369a1971

    • SHA1

      e9b5cb6ba9f54d1594cec043c469d5f46208df07

    • SHA256

      05b1f6d34238696d522cb7519a113abdbd74dfd2b32b43fa0709b6dd5ed57e64

    • SHA512

      bd4af60fd58abe00da32228e0dfe63cf203af14c8af2732cd708907ecc1d14a191dd78af5843fca9c5f393d4e4619b4f69b200225e15211a51eb7bbf1dca45ea

    • SSDEEP

      24576:RcF2ddLBEH/yuGeb3+yPbduheDDx0OJ13TPWi+D:SQ3yhugD7Tu5D

    Score
    10/10
    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks