Overview

overview

10

Static

static

3

456d293ee0...18.exe

windows7-x64

10

456d293ee0...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    456d293ee065a67f35ff9df70c1c05e2_JaffaCakes118

  • Size

    1.1MB

  • Sample

    241015-c6fs2svakq

  • MD5

    456d293ee065a67f35ff9df70c1c05e2

  • SHA1

    492a2e7f80f73ebe9f9949858d3980d0e5264b62

  • SHA256

    78136bd4e41f6a2e4dd7c9b765dd6ffb2b2e86b5362405efe237a1e2a62444bd

  • SHA512

    e8382bb68110b8f30925eb6d9705df5a38640afdfc7ae70d0a514be0aaad23a124252e3cebe20a666921e649735e5343f675bc30737431132c0d683d3d7101f8

  • SSDEEP

    24576:Jj8CAyECDWSv+0MgGEgdfIMD/a1pvqvw:JACAyhz+0MgNK3+7vqv

Score
10/10
danabot4bankerdiscoverytrojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.206.50:443

142.11.244.124:443
Attributes
  • embedded_hash

    6AD9FE4F9E491E785665E0D144F61DAB

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      456d293ee065a67f35ff9df70c1c05e2_JaffaCakes118

    • Size

      1.1MB

    • MD5

      456d293ee065a67f35ff9df70c1c05e2

    • SHA1

      492a2e7f80f73ebe9f9949858d3980d0e5264b62

    • SHA256

      78136bd4e41f6a2e4dd7c9b765dd6ffb2b2e86b5362405efe237a1e2a62444bd

    • SHA512

      e8382bb68110b8f30925eb6d9705df5a38640afdfc7ae70d0a514be0aaad23a124252e3cebe20a666921e649735e5343f675bc30737431132c0d683d3d7101f8

    • SSDEEP

      24576:Jj8CAyECDWSv+0MgGEgdfIMD/a1pvqvw:JACAyhz+0MgNK3+7vqv

    Score
    10/10
    danabot4bankerdiscoverytrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot Loader Component

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks