Overview

overview

10

Static

static

1

YE.jpg

windows10-2004-x64

10

Resubmissions

04/03/2024, 07:39

240304-jg8k4aeb5610

04/03/2024, 07:33

240304-jd2ndada4110

04/03/2024, 07:16

240304-h3sw4acf8v10

Sharing

Copy URL Twitter E-mail

General

  • Target
    YE.jpg
  • Size 1.9MB
  • Sample240304-jd2ndada41
  • SHA256 806fb0b10366bb1923a9d4e4545ab76d589a1848eb758c978bc349ca86b22c54
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
danabotbankerbotnettrojan

Malware Config

Extracted

Language

  • xlm4.0

Source
URLs
  • xlm40.dropper

    https://erpoweredent.at/3/zte.dll

Extracted

Family

  • danabot

C2

  • 51.178.195.151

  • 51.222.39.81

  • 149.255.35.125

  • 38.68.50.179

  • 51.77.7.204

rsa_pubkey.plain

Targets

    • Target
      YE.jpg
    • Size 1.9MB
    • SHA256 806fb0b10366bb1923a9d4e4545ab76d589a1848eb758c978bc349ca86b22c54
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    danabotbankerbotnettrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot x86 payload

      Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

      botnet

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks