Overview

overview

10

Static

static

3

d21dcfd40c...18.exe

windows7-x64

10

d21dcfd40c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d21dcfd40ce6dd227a6a7447fc11544f_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240405-m9h3paag62

  • MD5

    d21dcfd40ce6dd227a6a7447fc11544f

  • SHA1

    2214970e6a571f49f94c456ac755018fa3f81985

  • SHA256

    233df04bc2ee124e7af1399d77450d7db5985ce99defde5ce0604d592bfffc77

  • SHA512

    9edd6afa0ad0e94769bce5b5de6297ac5ba140b861662113ff1a52976a91ef6382f6d8e1efabbf56b34b6da122e0269b37363eb263d196c1b6c7a35d64009bc2

  • SSDEEP

    24576:yq4oCe5k1qVHBoHUkIjHipP+EtXldQz+iZlhB0H8b:D4J3mHaTmEpld6zlg

Score
10/10
danabot4bankertrojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

192.119.110.73:443

192.236.147.159:443

192.210.222.88:443
Attributes
  • embedded_hash

    F4711E27D559B4AEB1A081A1EB0AC465

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      d21dcfd40ce6dd227a6a7447fc11544f_JaffaCakes118

    • Size

      1.1MB

    • MD5

      d21dcfd40ce6dd227a6a7447fc11544f

    • SHA1

      2214970e6a571f49f94c456ac755018fa3f81985

    • SHA256

      233df04bc2ee124e7af1399d77450d7db5985ce99defde5ce0604d592bfffc77

    • SHA512

      9edd6afa0ad0e94769bce5b5de6297ac5ba140b861662113ff1a52976a91ef6382f6d8e1efabbf56b34b6da122e0269b37363eb263d196c1b6c7a35d64009bc2

    • SSDEEP

      24576:yq4oCe5k1qVHBoHUkIjHipP+EtXldQz+iZlhB0H8b:D4J3mHaTmEpld6zlg

    Score
    10/10
    danabot4bankertrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot Loader Component

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks