Overview

overview

10

Static

static

3

3e414a1e6b...35.exe

windows7-x64

10

3e414a1e6b...35.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9eaad9cd7a8fcc5282ce995a4d3b58618cde7b0d37c284182f2db178403df7fd

  • Size

    1.0MB

  • Sample

    240831-nlhmpa1cmq

  • MD5

    5642e154592a8ae94d4fb5cfda56bc0e

  • SHA1

    e7ad001a47d9f5d11a7fe31bb10823764502abf8

  • SHA256

    9eaad9cd7a8fcc5282ce995a4d3b58618cde7b0d37c284182f2db178403df7fd

  • SHA512

    e5a3f2a230d1ea8567cec103fb554fc9a8efe431d3e2d448df34207cfb67cb0c53416835507d5247811519c239c76d3e11e1ca524159eb1c6df92d3b566c822e

  • SSDEEP

    24576:ae9TCjhjtZ/PN33mn5E2nu9QQzk+RrUhuLJ2IT4XFBrc:acoZZPlLiu99z3Uu1TSPc

Score
10/10
danabot4bankerdiscoverytrojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

192.119.110.73:443

192.236.147.159:443

192.210.222.88:443
Attributes
  • embedded_hash

    F4711E27D559B4AEB1A081A1EB0AC465

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      3e414a1e6b83292a1d78c827eec6e4befde73128f166803ca686fa7b063bb635

    • Size

      1.2MB

    • MD5

      4f832af23cf6707b5fd6af2ec8e56b6c

    • SHA1

      e8a0e3479a058c865af87bf0807b3866a5d44902

    • SHA256

      3e414a1e6b83292a1d78c827eec6e4befde73128f166803ca686fa7b063bb635

    • SHA512

      cbd34b3ccc8b0d26359ad91965362b87bc4cc518d14d8c6afcef7d8af43c9576d172672f88c4b8110fe5560ffdcd537a6f0385c3c43be43947e6f9b281558eca

    • SSDEEP

      24576:gto0dy9qVHElC25o+pRUzCMKguakpj4l4GlC/fjVOQW100kc6:gto0/pO1Ez8jppcl4GYZTW1R6

    Score
    10/10
    danabot4bankerdiscoverytrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot Loader Component

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks