General

  • Target
    9a9c29b7c86f85ba69867fe9eca96032
  • Size 17.5MB
  • Sample240214-drg81agg68
  • SHA256 21917cd411471ca69b1c99e31021daca3abb99230847fabd831efa9f262c9d91
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10

Malware Config

Extracted

Family
  • danabot

Version
  • 1987

Botnet
  • 15

C2
  • 192.52.166.169:443

  • 173.254.204.95:443

  • 192.52.167.45:443

Attributes
  • embedded_hash

    D6A9A294BFDC6F13BFCC2AB0FA9B54B9

  • type

    main

rsa_privkey.plain
rsa_pubkey.plain

Signatures

  • Danabot family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • 9a9c29b7c86f85ba69867fe9eca96032
    .dll 17.5MB

9a9c29b7c86f85ba69867fe9eca96032

  • IMPHASH 908afa7baa08116e817d0ade28b27ef3
  • SHA256 21917cd411471ca69b1c99e31021daca3abb99230847fabd831efa9f262c9d91
  • MD5 SHA1 SHA512 SSDEEP
  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
0
Major OS version
5
Entry point
14708360
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI
PDB paths