Overview

overview

10

Static

static

3

4190fb8de9...18.exe

windows7-x64

10

4190fb8de9...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4190fb8de9d6a4200750b4d8d54f0720_JaffaCakes118

  • Size

    1.1MB

  • Sample

    241013-xr4lsashna

  • MD5

    4190fb8de9d6a4200750b4d8d54f0720

  • SHA1

    5385fd2aee08a6063dd0527ff8a07d74f8bb61b8

  • SHA256

    32b613fc579cc69e56997a4f3c41fd55b98ceb789d324408f450c2b6ad6d03bd

  • SHA512

    fdaafd89eac9b7f7a540038dbce48cf0e39c4aaa78dfbd6b0b45041386b23f64f827d5e51910fd4b2b7dc4ebde76a5c8ef8a9b9859cb5ca5a1ef4c84b5fdb033

  • SSDEEP

    24576:iv3TbcUVydzoxg50b5SS4SnEynTd+2yda5ZJBWJBrYurUE/I:ivHc5zOgOfVnEsZ1MajusuYD

Score
10/10
danabot4bankerdiscoverytrojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.244.124:443

142.11.206.50:443
Attributes
  • embedded_hash

    6AD9FE4F9E491E785665E0D144F61DAB

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      4190fb8de9d6a4200750b4d8d54f0720_JaffaCakes118

    • Size

      1.1MB

    • MD5

      4190fb8de9d6a4200750b4d8d54f0720

    • SHA1

      5385fd2aee08a6063dd0527ff8a07d74f8bb61b8

    • SHA256

      32b613fc579cc69e56997a4f3c41fd55b98ceb789d324408f450c2b6ad6d03bd

    • SHA512

      fdaafd89eac9b7f7a540038dbce48cf0e39c4aaa78dfbd6b0b45041386b23f64f827d5e51910fd4b2b7dc4ebde76a5c8ef8a9b9859cb5ca5a1ef4c84b5fdb033

    • SSDEEP

      24576:iv3TbcUVydzoxg50b5SS4SnEynTd+2yda5ZJBWJBrYurUE/I:ivHc5zOgOfVnEsZ1MajusuYD

    Score
    10/10
    danabot4bankerdiscoverytrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot Loader Component

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks