General

  • Target

    5fb7efbe7df0a78dbe6be7b15a527c0e

  • Size

    1.3MB

  • Sample

    240116-m1bbgsaber

  • MD5

    5fb7efbe7df0a78dbe6be7b15a527c0e

  • SHA1

    60f30c7deacca0a7c71a923b0309708bdedcc4e2

  • SHA256

    55a5debb37f3f6a5812fa4657b9c8224be329526a423309856dadc03d35fd611

  • SHA512

    bae3a8a6cedca7907ecb974a5d35a69ee7a75040753bf1b4dcc7a8ae875c2a9a999e889fc666c55b9d7fc1a43b3409c487aa5fc2487a5d7bdfc9522e4f7f8bb9

  • SSDEEP

    24576:i8FGpsnNxiY7m7Nqrh211ePCDMD2KTMmi:p3ftA12CDkTTi

Score
10/10

Malware Config

Extracted

Family

danabot

Botnet

4

C2

23.229.29.48:443

5.9.224.204:443

192.210.222.81:443

Attributes
  • embedded_hash

    0E1A7A1479C37094441FA911262B322A

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      5fb7efbe7df0a78dbe6be7b15a527c0e

    • Size

      1.3MB

    • MD5

      5fb7efbe7df0a78dbe6be7b15a527c0e

    • SHA1

      60f30c7deacca0a7c71a923b0309708bdedcc4e2

    • SHA256

      55a5debb37f3f6a5812fa4657b9c8224be329526a423309856dadc03d35fd611

    • SHA512

      bae3a8a6cedca7907ecb974a5d35a69ee7a75040753bf1b4dcc7a8ae875c2a9a999e889fc666c55b9d7fc1a43b3409c487aa5fc2487a5d7bdfc9522e4f7f8bb9

    • SSDEEP

      24576:i8FGpsnNxiY7m7Nqrh211ePCDMD2KTMmi:p3ftA12CDkTTi

    Score
    10/10
    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Danabot Loader Component

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks