danabot

General

Target

9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe
Size

1.1MB
Sample

240724-xtsx3asejq
MD5

68861f3f1f2928c83b8203e7c45bedc2
SHA1

6c410f8ac0deb98d2a682b63a7f26c791a3a6dd7
SHA256

749c23656b53bfd0ec3609f16ad0198fc38e5af9af1826820e4133cb88f9ec97
SHA512

f9a1dbaaf10919ea61413d1ed6b28d7768fadfcb8d863a4417b5512fd085f70324a40853d3c78a58adf6fdacbb4c9d6670adf365c853000da00064fdccdf971a
SSDEEP

24576:ovJqlPrBW4AvDvS0wpT8AoJ92oZgFO037cs:o2jI4AvjGpbSE3os

Score

10^/10

danabot 5 aspackv2 banker discovery trojan

Malware Config

Extracted

Family

danabot

Botnet

5

C2

23.254.217.192:443

192.236.146.173:443

23.254.133.7:443

185.62.58.85:443

Attributes

embedded_hash
3CCDCA270E94321B76E2E66C454CD541
type
loader

Targets

- Target
  
  9310DAF6D10F4FBFAF390E74BCF1C4D9ACC023D7DB3E26030F8772528572A22A.exe
- Size
  
  1.1MB
- MD5
  
  68861f3f1f2928c83b8203e7c45bedc2
- SHA1
  
  6c410f8ac0deb98d2a682b63a7f26c791a3a6dd7
- SHA256
  
  749c23656b53bfd0ec3609f16ad0198fc38e5af9af1826820e4133cb88f9ec97
- SHA512
  
  f9a1dbaaf10919ea61413d1ed6b28d7768fadfcb8d863a4417b5512fd085f70324a40853d3c78a58adf6fdacbb4c9d6670adf365c853000da00064fdccdf971a
- SSDEEP
  
  24576:ovJqlPrBW4AvDvS0wpT8AoJ92oZgFO037cs:o2jI4AvjGpbSE3os
Score

10^/10

danabot 5 aspackv2 banker discovery trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Blocklisted process makes network request
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Blocklisted process makes network request

ASPack v2.12-2.42

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2