General
Static task
static1
URLScan task
urlscan1
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
http://blockchainjoblist.com/wp-admin/014080/
-
exe.dropper
https://womenempowermentpakistan.com/wp-admin/paba5q52/
-
exe.dropper
https://atnimanvilla.com/wp-content/073735/
-
exe.dropper
https://yeuquynhnhai.com/upload/41830/
-
exe.dropper
https://deepikarai.com/js/4bzs6/
Extracted
Family
-
danabot
C2
-
51.178.195.151
-
51.222.39.81
-
149.255.35.125
-
38.68.50.179
-
51.77.7.204
rsa_pubkey.plain
Targets
-
Danabot x86 payload
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Loads dropped DLL
Legitimate hosting services abused for malware hosting/C2