danabot | 987f20ff829ea4c324d87ca9b55860111b827d0fdb01499bb704074d9d220016 | Triage

Sharing

General

Target

7ee0c1c8f76bd87982f5e238d7cf44d3
Size

1.1MB
Sample

240129-e1dgvahgf7
MD5

7ee0c1c8f76bd87982f5e238d7cf44d3
SHA1

6f476c2ac0b7e83605ed9eeafdd0461c807240ac
SHA256

987f20ff829ea4c324d87ca9b55860111b827d0fdb01499bb704074d9d220016
SHA512

a0eefc162bd60a1c7a6770f9b017a94ba185c9802acb975f56372026851b1fff5192f5faed61aff1a4854587c5941fd1456821621fc72bf6fdc0f46e379ed06c
SSDEEP

24576:27l+B6syClv2eGZCFNJ0/CuDOAzKskZJFdyjxzpJDgmvNsXL:eRCl9GZqs/CgxyFI17kmvaXL

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

23.229.29.48:443

5.9.224.204:443

192.210.222.81:443

Attributes

embedded_hash
0E1A7A1479C37094441FA911262B322A
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Targets

- Target
  
  7ee0c1c8f76bd87982f5e238d7cf44d3
- Size
  
  1.1MB
- MD5
  
  7ee0c1c8f76bd87982f5e238d7cf44d3
- SHA1
  
  6f476c2ac0b7e83605ed9eeafdd0461c807240ac
- SHA256
  
  987f20ff829ea4c324d87ca9b55860111b827d0fdb01499bb704074d9d220016
- SHA512
  
  a0eefc162bd60a1c7a6770f9b017a94ba185c9802acb975f56372026851b1fff5192f5faed61aff1a4854587c5941fd1456821621fc72bf6fdc0f46e379ed06c
- SSDEEP
  
  24576:27l+B6syClv2eGZCFNJ0/CuDOAzKskZJFdyjxzpJDgmvNsXL:eRCl9GZqs/CgxyFI17kmvaXL
Score

10^/10

danabot 4 banker trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Blocklisted process makes network request
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

danabot4bankertrojan

behavioral2

danabot4bankertrojan