Overview

overview

10

Static

static

3

DanaBot.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DanaBot.exe

  • Size

    2.7MB

  • Sample

    241015-r8plasvbpl

  • MD5

    48d8f7bbb500af66baa765279ce58045

  • SHA1

    2cdb5fdeee4e9c7bd2e5f744150521963487eb71

  • SHA256

    db0d72bc7d10209f7fa354ec100d57abbb9fe2e57ce72789f5f88257c5d3ebd1

  • SHA512

    aef8aa8e0d16aab35b5cc19487e53583691e4471064bc556a2ee13e94a0546b54a33995739f0fa3c4de6ff4c6abf02014aef3efb0d93ca6847bad2220c3302bd

  • SSDEEP

    49152:bbevayZlMTWkygVy0nQZfVY2BtZzpPL4PuQ65+6Dv7m0KXTn:bbexZlMQcEVY2BtZzpPL4WQI9U

Score
10/10
danabotbankerbotnetdiscoverytrojan

Malware Config

Extracted

Family

danabot

C2

51.178.195.151

51.222.39.81

149.255.35.125

38.68.50.179

51.77.7.204
rsa_pubkey.plain

Targets

    • Target

      DanaBot.exe

    • Size

      2.7MB

    • MD5

      48d8f7bbb500af66baa765279ce58045

    • SHA1

      2cdb5fdeee4e9c7bd2e5f744150521963487eb71

    • SHA256

      db0d72bc7d10209f7fa354ec100d57abbb9fe2e57ce72789f5f88257c5d3ebd1

    • SHA512

      aef8aa8e0d16aab35b5cc19487e53583691e4471064bc556a2ee13e94a0546b54a33995739f0fa3c4de6ff4c6abf02014aef3efb0d93ca6847bad2220c3302bd

    • SSDEEP

      49152:bbevayZlMTWkygVy0nQZfVY2BtZzpPL4PuQ65+6Dv7m0KXTn:bbexZlMQcEVY2BtZzpPL4WQI9U

    Score
    10/10
    danabotbankerbotnetdiscoverytrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot x86 payload

      Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

      botnet

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks