General

  • Target

    0cfd03266f99df85fae3efe5cb24faa98cf4a4b9cc628d15b778abd53ebf3e7f

  • Size

    2.5MB

  • Sample

    241028-yf3e1swanh

  • MD5

    36abe5f8062fba9d27e649a24d563656

  • SHA1

    713250a4385d051f078cc34adf5c001529abb121

  • SHA256

    0cfd03266f99df85fae3efe5cb24faa98cf4a4b9cc628d15b778abd53ebf3e7f

  • SHA512

    212f74e949515fd95c35e8f6fb5bcca47874cf8d4874b7eec18f1d456e52da76e15202a3e56d53c2e5795f3a4101f6a840c4e931a1e32e4186b4657ea40f2d61

  • SSDEEP

    49152:CgZziYTT//Yzt2Z/fZMdzUAOC5n+LlrxFTGWwKq:C0ziYTkR2Z/f6AAOGarxFTG3v

Malware Config

Extracted

Family

danabot

Botnet

40

C2

185.158.250.216:443

194.76.225.46:443

45.11.180.153:443

194.76.225.61:443

Attributes
  • embedded_hash

    AD14EA44261341E3690FA8CC1E236523

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      0cfd03266f99df85fae3efe5cb24faa98cf4a4b9cc628d15b778abd53ebf3e7f

    • Size

      2.5MB

    • MD5

      36abe5f8062fba9d27e649a24d563656

    • SHA1

      713250a4385d051f078cc34adf5c001529abb121

    • SHA256

      0cfd03266f99df85fae3efe5cb24faa98cf4a4b9cc628d15b778abd53ebf3e7f

    • SHA512

      212f74e949515fd95c35e8f6fb5bcca47874cf8d4874b7eec18f1d456e52da76e15202a3e56d53c2e5795f3a4101f6a840c4e931a1e32e4186b4657ea40f2d61

    • SSDEEP

      49152:CgZziYTT//Yzt2Z/fZMdzUAOC5n+LlrxFTGWwKq:C0ziYTkR2Z/f6AAOGarxFTG3v

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Danabot Loader Component

    • Danabot family

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks