Overview

overview

10

Static

static

10

92fcf8a509...24.dll

windows7-x64

10

92fcf8a509...24.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0b80b66459a9d4cbad76473e2f2fe6c3.zip

  • Size

    559KB

  • Sample

    240831-km8zgsvepr

  • MD5

    cfd94e6716f81563881fc00a26470146

  • SHA1

    43a07777976c826b840fdbb7abce9a24d2a59d5c

  • SHA256

    c7fe9630c60ba1ccf33b7a15c450c8a17d589c29934d5f665554c645e965d698

  • SHA512

    88b14ed2456a03161e506426859ae748839e1d723bdb264f1dbf4df70206daf7f115165793a0b177900a4cf6d39bf40df1ea414d5c7a69e497d58b89a3906752

  • SSDEEP

    12288:bSzjU1CagvpMdjH4fQnOyz+h338GAtMU0eNblRc9/wFnv:+zj8CFh2H4uUh+Mv6pS9/wFv

Score
10/10
danabot4bankerdiscoverytrojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

192.119.110.73:443

192.236.147.159:443

192.210.222.88:443
Attributes
  • embedded_hash

    F4711E27D559B4AEB1A081A1EB0AC465

  • type

    loader

Targets

    • Target

      92fcf8a5096e83dea0dcb77251f22c06da713ad6082a22bd07ef1756e23ab924

    • Size

      1.3MB

    • MD5

      0b80b66459a9d4cbad76473e2f2fe6c3

    • SHA1

      3eb1f651c975d5ce9a9023ec040edc3792d9716a

    • SHA256

      92fcf8a5096e83dea0dcb77251f22c06da713ad6082a22bd07ef1756e23ab924

    • SHA512

      7333f72f6836f06fb62e77d39c3e4dc6edfce83c58730f8aa8376b05440dc47c5b758c99cd144f8c10000861570f6767c6ef9f01b59275e6c8dcff4fa8048ae7

    • SSDEEP

      24576:GncFdh7rbCc1XupdscfiyWOrLYgt4LCpo+TJgag:lhe6xOTyP+T

    Score
    10/10
    danabot4bankerdiscoverytrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot Loader Component

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks