danabot

General

Target
6da426e667bd9c1d5b587049fa913c41a0e150a2422aa1b01ab0a803048e37db.exe
Size 1.1MB
Sample240725-d6agpswerq
SHA256 6da426e667bd9c1d5b587049fa913c41a0e150a2422aa1b01ab0a803048e37db
MD5 3f08f2c68c3d12cf753a9d7f7f13a775
SHA1 46c7ba1688f16fae39ee83818028b931f1327398
SHA512 422c663c2bf44c07c2f71f3ddb59025d65c0f6573380873da88879014c9bac6a7e772696ecd0cdb72897885d5154446caefbec558a20104bbf994f3375c3f2ae
SSDEEP 12288:q3vqr/B17jAPeQp37W9nsLx3EXWcUoHM00znmPJcWZTziS5Zugfz3xaCXBKQp6:IvqrPjALp2sdyNUCM0yGPZuEZugbWQg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

danabot 5 aspackv2 banker discovery trojan

Malware Config

Extracted

Family

danabot

Botnet

5

C2

23.254.217.192:443
192.236.146.173:443
23.254.133.7:443
185.62.58.85:443

Attributes

embedded_hash
3CCDCA270E94321B76E2E66C454CD541
type
loader

Targets

- Target
  6da426e667bd9c1d5b587049fa913c41a0e150a2422aa1b01ab0a803048e37db.exe
- Size 1.1MB
- SHA256 6da426e667bd9c1d5b587049fa913c41a0e150a2422aa1b01ab0a803048e37db
- MD5 3f08f2c68c3d12cf753a9d7f7f13a775
- SHA1 46c7ba1688f16fae39ee83818028b931f1327398
- SHA512 422c663c2bf44c07c2f71f3ddb59025d65c0f6573380873da88879014c9bac6a7e772696ecd0cdb72897885d5154446caefbec558a20104bbf994f3375c3f2ae
- SSDEEP 12288:q3vqr/B17jAPeQp37W9nsLx3EXWcUoHM00znmPJcWZTziS5Zugfz3xaCXBKQp6:IvqrPjALp2sdyNUCM0yGPZuEZugbWQg
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

danabot 5 aspackv2 banker discovery trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Blocklisted process makes network request
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Blocklisted process makes network request

ASPack v2.12-2.42

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2