General

  • Target

    2c269d932b52ff71a1429e94cd020c9f

  • Size

    1.2MB

  • Sample

    231231-hjycgahdgn

  • MD5

    2c269d932b52ff71a1429e94cd020c9f

  • SHA1

    4de5a5fca618479c84e84f27bfdf589b692a5bea

  • SHA256

    f231fc321d5bfd7623b731251d4231ebd317916507696795ce0a091cb8e4dead

  • SHA512

    4f794cc19fdb840203782351d0b5216d34e8965892b47faa322b75b0b862d8d38362da314b0cd916bd6202f5a0c577bb7e7636042e65b03f1cf50b6730f73119

  • SSDEEP

    24576:dHTYEG8wB1j9pMKDe+TJ/IY3G+VYbw8FcIF4aWVTS:d3g9pxDpTJ/IUVYbw8FGaGm

Score
10/10

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.244.124:443

142.11.206.50:443

Attributes
  • embedded_hash

    6AD9FE4F9E491E785665E0D144F61DAB

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      2c269d932b52ff71a1429e94cd020c9f

    • Size

      1.2MB

    • MD5

      2c269d932b52ff71a1429e94cd020c9f

    • SHA1

      4de5a5fca618479c84e84f27bfdf589b692a5bea

    • SHA256

      f231fc321d5bfd7623b731251d4231ebd317916507696795ce0a091cb8e4dead

    • SHA512

      4f794cc19fdb840203782351d0b5216d34e8965892b47faa322b75b0b862d8d38362da314b0cd916bd6202f5a0c577bb7e7636042e65b03f1cf50b6730f73119

    • SSDEEP

      24576:dHTYEG8wB1j9pMKDe+TJ/IY3G+VYbw8FcIF4aWVTS:d3g9pxDpTJ/IUVYbw8FGaGm

    Score
    10/10
    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Danabot Loader Component

    • Blocklisted process makes network request

    • Loads dropped DLL

MITRE ATT&CK Matrix

Tasks