Overview

overview

10

Static

static

3

551660c6e0...18.exe

windows7-x64

10

551660c6e0...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    551660c6e0c076f97d58f9aa11b0efa8_JaffaCakes118

  • Size

    1.1MB

  • Sample

    241018-dd219asgqb

  • MD5

    551660c6e0c076f97d58f9aa11b0efa8

  • SHA1

    ecc1f533e6b0dfd7bcee6e75531fc5919115ed05

  • SHA256

    c9b82cf2205251f479681eafa5d117ba0b79a9501275e9f0210a9acbdb679057

  • SHA512

    17273ff759718586fb2b83a109fc1ffe92c08468a45f165c5a514feb86db3d8f40fe5714a24937b57ba62bc64fbda7f58a40c78690429838fce45437f0651f6d

  • SSDEEP

    24576:mqau2QHbMtj3PsqwJb78Ae9lSH6TKHRE8XX0AH819lJN9:ml+HbMBsqwp772oHPHzH8B

Score
10/10
danabot4bankerdiscoverytrojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.244.124:443

142.11.206.50:443
Attributes
  • embedded_hash

    6AD9FE4F9E491E785665E0D144F61DAB

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      551660c6e0c076f97d58f9aa11b0efa8_JaffaCakes118

    • Size

      1.1MB

    • MD5

      551660c6e0c076f97d58f9aa11b0efa8

    • SHA1

      ecc1f533e6b0dfd7bcee6e75531fc5919115ed05

    • SHA256

      c9b82cf2205251f479681eafa5d117ba0b79a9501275e9f0210a9acbdb679057

    • SHA512

      17273ff759718586fb2b83a109fc1ffe92c08468a45f165c5a514feb86db3d8f40fe5714a24937b57ba62bc64fbda7f58a40c78690429838fce45437f0651f6d

    • SSDEEP

      24576:mqau2QHbMtj3PsqwJb78Ae9lSH6TKHRE8XX0AH819lJN9:ml+HbMBsqwp772oHPHzH8B

    Score
    10/10
    danabot4bankerdiscoverytrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot Loader Component

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks