Overview

overview

10

Static

static

1

DHL_060520...41.vbs

windows7-x64

10

DHL_060520...41.vbs

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    f70af025548df40e384bc4bac11d78f5_JaffaCakes118
  • Size 279KB
  • Sample240418-ce4qsshc9s
  • SHA256 6c569d751bad1c483e441d11fddd7163682835c963834014bc22481a7abe1163
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
danabotbankerbotnettrojan

Malware Config

Extracted

Family

  • danabot

C2

  • 17.87.135.29

  • 178.209.51.211

  • 92.19.7.22

  • 192.71.249.51

  • 125.204.180.169

  • 182.91.160.38

  • 35.132.27.153

  • 11.32.49.47

  • 50.64.117.111

  • 121.215.98.191

rsa_pubkey.plain

Targets

    • Target
      DHL_06052019_00330134265324053041.vbs
    • Size 1.5MB
    • SHA256 d0d6b5440599fb7f047c0f2c933f2291c308d8c755d03d50097d7509005898f0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    danabotbankerbotnettrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot x86 payload

      Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

      botnet

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks