General

  • Target

    1c820d3049349ca75af1e835373d5e79

  • Size

    1.3MB

  • Sample

    231230-zy3zyabfh5

  • MD5

    1c820d3049349ca75af1e835373d5e79

  • SHA1

    c4986b74cdc34038977f7d1105a3703020358254

  • SHA256

    05c56eae3338a2452fda330e9380442c7e5e630865fcdd8fc5af879746de1bda

  • SHA512

    6d46cb0af71d3a6f78cd939db380a8b39fd9821807077ac44ac39f8805f9d60d721b3a6d56bf4ed37fbf9edfaed3b3b7bb42fa9fe41c12e2be3bd0b5d9dbf08d

  • SSDEEP

    12288:Ns8Fy+Hu9nN4vYH2a7Ncf04W2O/SYOsm99UXfkTeMRsHQ0:S8FGyvFaRg04W2O6YOsm999TeMyH

Score
10/10

Malware Config

Extracted

Family

danabot

Botnet

4

C2

23.229.29.48:443

192.210.222.81:443

Attributes
  • embedded_hash

    0E1A7A1479C37094441FA911262B322A

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      1c820d3049349ca75af1e835373d5e79

    • Size

      1.3MB

    • MD5

      1c820d3049349ca75af1e835373d5e79

    • SHA1

      c4986b74cdc34038977f7d1105a3703020358254

    • SHA256

      05c56eae3338a2452fda330e9380442c7e5e630865fcdd8fc5af879746de1bda

    • SHA512

      6d46cb0af71d3a6f78cd939db380a8b39fd9821807077ac44ac39f8805f9d60d721b3a6d56bf4ed37fbf9edfaed3b3b7bb42fa9fe41c12e2be3bd0b5d9dbf08d

    • SSDEEP

      12288:Ns8Fy+Hu9nN4vYH2a7Ncf04W2O/SYOsm99UXfkTeMRsHQ0:S8FGyvFaRg04W2O6YOsm999TeMyH

    Score
    10/10
    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Danabot Loader Component

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks