Overview

overview

10

Static

static

1

CRA_INV_20...18.vbs

windows7-x64

10

CRA_INV_20...18.vbs

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    94f0e30a7d10fb1b21f63b28c18e858b_JaffaCakes118
  • Size 2.1MB
  • Sample240604-qaf1tshb46
  • SHA256 56e5141838117a72da51f61f1e3e83b23ac9ba26afb3bd712ebb55fff6482efb
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
danabotbankertrojan

Malware Config

Extracted

Family

  • danabot

C2

  • 181.63.44.194

  • 207.148.83.108

  • 45.77.40.71

  • 87.115.138.169

  • 24.229.48.7

  • 116.111.206.27

  • 45.196.143.203

  • 218.65.3.199

  • 131.59.110.186

  • 113.81.97.96

rsa_pubkey.plain

Targets

    • Target
      CRA_INV_2019_552913887418/CRA_INV_2019_552913887418.vbs
    • Size 24.2MB
    • SHA256 38c668144becb1199196394ad78df6694c86597a283aea61bd036dc1da2eef62
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    danabotbankertrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks