Overview

overview

10

Static

static

1

URLScan

urlscan

https://github.com/D...

windows10-2004-x64

Resubmissions

24-02-2024 23:16

240224-29fd5ahd4w 10

24-02-2024 22:21

240224-191jmage7y 10

24-02-2024 22:06

240224-11gedsfe93 10

24-02-2024 22:03

240224-1yt8gafe62 1

24-02-2024 21:54

240224-1sjjsagb7z 7

24-02-2024 21:50

240224-1pv4eagb3v 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    https://github.com/Da2dalus/The-MALWARE-Repo

  • Sample

    240224-191jmage7y

Score
10/10
danabotbankerbotnetevasionransomwaretrojan

Malware Config

Extracted

Family

danabot

C2

51.178.195.151

51.222.39.81

149.255.35.125

38.68.50.179

51.77.7.204
rsa_pubkey.plain

Targets

    • Target

      https://github.com/Da2dalus/The-MALWARE-Repo

    Score
    10/10
    danabotbankerbotnetevasionransomwaretrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot x86 payload

      Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

      botnet

    • Blocklisted process makes network request

    • Disables Task Manager via registry modification

      evasion

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Resource Development

Reconnaissance

Tasks