danabot

General

Target
0F8D2648166184BDE6562F33B7E4B620313FE7A21746720D37594213FBA7A604.exe
Size 1.1MB
Sample240724-nest3stdpj
SHA256 ef5c8d37fe7ad48a47e8127a1e3935fde4a37c0295d7b547ef067d97ea999434
MD5 16d76956de4e24c0067278a8c3a8e2dd
SHA1 97a0a15c115ca7bd993df204117ff4d3a463c5a5
SHA512 41e7c87cbcd239f430557185fe0390c100aed95fbd0e70dd36755123d23930f90e31ef5b8aa9bc0ec8237b8a6af2e0fa922ae67e39dcf5077795e105a7829331
SSDEEP 12288:dpKrcz9GQmikzLgiaYb0ZPzxwbwgyScsWMifc0FrdbH7+esjQajwROmBVe3Rac26:rAcz9EikngXP6NB8cyz73OH6k86
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

danabot 5 aspackv2 banker discovery trojan

Malware Config

Extracted

Family

danabot

Botnet

5

C2

23.254.133.7:443
185.62.58.85:443
213.227.155.102:443
192.236.146.173:443

Attributes

embedded_hash
63B180866F08EFD2B286E54429F1D1E4
type
loader

Targets

- Target
  0F8D2648166184BDE6562F33B7E4B620313FE7A21746720D37594213FBA7A604.exe
- Size 1.1MB
- SHA256 ef5c8d37fe7ad48a47e8127a1e3935fde4a37c0295d7b547ef067d97ea999434
- MD5 16d76956de4e24c0067278a8c3a8e2dd
- SHA1 97a0a15c115ca7bd993df204117ff4d3a463c5a5
- SHA512 41e7c87cbcd239f430557185fe0390c100aed95fbd0e70dd36755123d23930f90e31ef5b8aa9bc0ec8237b8a6af2e0fa922ae67e39dcf5077795e105a7829331
- SSDEEP 12288:dpKrcz9GQmikzLgiaYb0ZPzxwbwgyScsWMifc0FrdbH7+esjQajwROmBVe3Rac26:rAcz9EikngXP6NB8cyz73OH6k86
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

danabot 5 aspackv2 banker discovery trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Blocklisted process makes network request
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Blocklisted process makes network request

ASPack v2.12-2.42

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2