Overview

overview

10

Static

static

10

19835fdeab...a4.dll

windows7-x64

10

19835fdeab...a4.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    578b41adb130906fab17854ac802039a.zip

  • Size

    554KB

  • Sample

    240903-frd8fsxgml

  • MD5

    f096116b846025227b49918d803ccf92

  • SHA1

    bb369ff4d5735ff04e7f15dc963213c614ff4a75

  • SHA256

    cd85c137e1bf8312076b0555893954a57ee1b9dd4807fae71068c49f93244616

  • SHA512

    1d736e4a973241a80c97c56d54a4d1a5435283c6d7849ef583c843faa9bb9b5d138e8d7d4c35f566776ce9de404d8f7b2bba6767d2eef9abfe5928e6e8f565c5

  • SSDEEP

    12288:FWBCpQtuNvoUqoHnVR8Wr2In4mOQiweH4338Ht+flMhZL1ZW0g4g:Fggn1HVC4BOVweHG3/aL1ZR6

Score
10/10
danabot4bankerdiscoverytrojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

192.119.110.73:443

192.236.147.159:443

192.210.222.88:443
Attributes
  • embedded_hash

    F4711E27D559B4AEB1A081A1EB0AC465

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      19835fdeabe926ae5d75109628791657cdf2d36f705399e07d896cc2faeb8ba4

    • Size

      1.3MB

    • MD5

      578b41adb130906fab17854ac802039a

    • SHA1

      075953fdfcc27bfcf77d58f7fe703286e69c312c

    • SHA256

      19835fdeabe926ae5d75109628791657cdf2d36f705399e07d896cc2faeb8ba4

    • SHA512

      f7e75e998da931e24acfe1840efe2cf4e8bda3b97c155ea068e6893143c1428e6d7291fc6221e98516e7fdd5280b78c56c8f954940fe031bf86e809fbeb3b19e

    • SSDEEP

      24576:0cF264v8zwx65ekOb0Hr71DU/aiXHsW9T5OQjx:3RVrhDeabeTo

    Score
    10/10
    danabot4bankerdiscoverytrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot Loader Component

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks