Overview

overview

10

Static

static

3

082e530d5e...18.exe

windows7-x64

10

082e530d5e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    082e530d5eca92e8ad49c1b8487c05aa_JaffaCakes118

  • Size

    1.1MB

  • Sample

    241002-bf94jazalp

  • MD5

    082e530d5eca92e8ad49c1b8487c05aa

  • SHA1

    89edd59fab8bc491df3da839edf3f718caa439c7

  • SHA256

    8cff81b24f92676593f4f654e3158e9ea0f41238222be749393434af8fa1eff4

  • SHA512

    7dc936ab5bb67c1b5222f684a42571effd17205fd9e39017ea41fff8907a33df08bbad3755d9e29bc58783e4d5563550fa64473515db0da1e7018007d006e9f5

  • SSDEEP

    24576:C/O45NET5YsT2Kg7ltHvfSRauFPjNUhBtExc0dDUkQ:gS5Ysy7l5CauFmhBtExc0DUkQ

Score
10/10
danabot4bankerdiscoverytrojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

193.34.167.138:443

142.11.206.50:443

142.11.244.124:443
Attributes
  • embedded_hash

    6AD9FE4F9E491E785665E0D144F61DAB

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      082e530d5eca92e8ad49c1b8487c05aa_JaffaCakes118

    • Size

      1.1MB

    • MD5

      082e530d5eca92e8ad49c1b8487c05aa

    • SHA1

      89edd59fab8bc491df3da839edf3f718caa439c7

    • SHA256

      8cff81b24f92676593f4f654e3158e9ea0f41238222be749393434af8fa1eff4

    • SHA512

      7dc936ab5bb67c1b5222f684a42571effd17205fd9e39017ea41fff8907a33df08bbad3755d9e29bc58783e4d5563550fa64473515db0da1e7018007d006e9f5

    • SSDEEP

      24576:C/O45NET5YsT2Kg7ltHvfSRauFPjNUhBtExc0dDUkQ:gS5Ysy7l5CauFmhBtExc0DUkQ

    Score
    10/10
    danabot4bankerdiscoverytrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot Loader Component

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks