General

  • Target
    http://adwaredownload
  • Sample240804-t8b2bazdkp

Malware Config

Extracted

Language
  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://blockchainjoblist.com/wp-admin/014080/

  • exe.dropper

    https://womenempowermentpakistan.com/wp-admin/paba5q52/

  • exe.dropper

    https://atnimanvilla.com/wp-content/073735/

  • exe.dropper

    https://yeuquynhnhai.com/upload/41830/

  • exe.dropper

    https://deepikarai.com/js/4bzs6/

Extracted

Family
  • danabot

C2
  • 51.178.195.151

  • 51.222.39.81

  • 149.255.35.125

  • 38.68.50.179

  • 51.77.7.204

rsa_pubkey.plain

Targets

    • Target
      http://adwaredownload
    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Danabot x86 payload

      Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks