danabot | 988d89d3b907b582e8c73f03a41c29d25f1efb3b7731b16692104047f5ceff54 | Triage

Sharing

General

Target

85eca4d79e6d5641120c37d371f7759e
Size

1.3MB
Sample

240201-e2589adbdp
MD5

85eca4d79e6d5641120c37d371f7759e
SHA1

12fdac7db7a90687eec642e452c8273f0612fb1f
SHA256

988d89d3b907b582e8c73f03a41c29d25f1efb3b7731b16692104047f5ceff54
SHA512

236bddfa1ac7ddea47c54540329d565c27f3beac9aad8baecd0aed0a2196b2b7da722e3acda7eefa52b1fe58dfa2b0beeab74bcdf9a1f24b44e3b5bd45763398
SSDEEP

24576:L8pWEmDXswcrLEEcQ1fObM5HqTgNmsBdPTWnrO:QtSzeTBdPTq

Score

10^/10

danabot 4 banker trojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

23.229.29.48:443

5.9.224.204:443

192.210.222.81:443

Attributes

embedded_hash
0E1A7A1479C37094441FA911262B322A
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Targets

- Target
  
  85eca4d79e6d5641120c37d371f7759e
- Size
  
  1.3MB
- MD5
  
  85eca4d79e6d5641120c37d371f7759e
- SHA1
  
  12fdac7db7a90687eec642e452c8273f0612fb1f
- SHA256
  
  988d89d3b907b582e8c73f03a41c29d25f1efb3b7731b16692104047f5ceff54
- SHA512
  
  236bddfa1ac7ddea47c54540329d565c27f3beac9aad8baecd0aed0a2196b2b7da722e3acda7eefa52b1fe58dfa2b0beeab74bcdf9a1f24b44e3b5bd45763398
- SSDEEP
  
  24576:L8pWEmDXswcrLEEcQ1fObM5HqTgNmsBdPTWnrO:QtSzeTBdPTq
Score

10^/10

danabot 4 banker trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Blocklisted process makes network request
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

danabot4bankertrojan

behavioral2

danabot4bankertrojan