General

  • Target

    e71e3313602cb23dd700e6cc789bc0d6_JaffaCakes118

  • Size

    1.4MB

  • Sample

    240917-sr5fvszhql

  • MD5

    e71e3313602cb23dd700e6cc789bc0d6

  • SHA1

    6b5c208cbcfcffd6f1dd40453ff7f3440ee4e220

  • SHA256

    b2f5e31c587e42af827c2d651da673ac289f5f04779eb445da4e3b045490ee10

  • SHA512

    4eb3752fea6cc9394707071ab9c76648c9e106438ae75d05e698937b421ec920010482819af70e50302d2cac7184cc5934692c6cffc1f4639b1deee21638e6ca

  • SSDEEP

    24576:I8F8mrbI2jsdJQSn3wwgMlfzhaEfyrTcem:bY3wklfzQhrTj

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.192.232:443

192.119.110.73:443

142.11.242.31:443

Attributes
  • embedded_hash

    F4711E27D559B4AEB1A081A1EB0AC465

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      e71e3313602cb23dd700e6cc789bc0d6_JaffaCakes118

    • Size

      1.4MB

    • MD5

      e71e3313602cb23dd700e6cc789bc0d6

    • SHA1

      6b5c208cbcfcffd6f1dd40453ff7f3440ee4e220

    • SHA256

      b2f5e31c587e42af827c2d651da673ac289f5f04779eb445da4e3b045490ee10

    • SHA512

      4eb3752fea6cc9394707071ab9c76648c9e106438ae75d05e698937b421ec920010482819af70e50302d2cac7184cc5934692c6cffc1f4639b1deee21638e6ca

    • SSDEEP

      24576:I8F8mrbI2jsdJQSn3wwgMlfzhaEfyrTcem:bY3wklfzQhrTj

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Danabot Loader Component

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks