General

  • Target

    4DFD30C831BA73843878FD323C48EF36.dll

  • Size

    1.9MB

  • Sample

    241103-znlmxavcpr

  • MD5

    4dfd30c831ba73843878fd323c48ef36

  • SHA1

    62e0f617c66526e8754b6f6523dc6f88f723ce17

  • SHA256

    bff61b3d082561847f3503d4a5e35f9fbffedf58a8e697708fba34fe1348b942

  • SHA512

    09efae12fead3aac45e189c37b9d6dc6f301fbbd2449aba96512f4a4569b6fb43f3f032ff0fe30579e4e4032d0764b2f0b36b930d3758a5aa721191dbc2942c0

  • SSDEEP

    49152:DQU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4Bve4qfn8+nFFQCxEsJwKQp:DfaNQh+NUABO/c0Y9AdI4qf8+gqJW

Malware Config

Extracted

Family

danabot

Botnet

40

C2

185.117.90.36:443

193.42.36.59:443

193.56.146.53:443

185.106.123.228:443

Attributes
  • embedded_hash

    07284E2A3AB3C2E1FFFBD425849BE150

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      4DFD30C831BA73843878FD323C48EF36.dll

    • Size

      1.9MB

    • MD5

      4dfd30c831ba73843878fd323c48ef36

    • SHA1

      62e0f617c66526e8754b6f6523dc6f88f723ce17

    • SHA256

      bff61b3d082561847f3503d4a5e35f9fbffedf58a8e697708fba34fe1348b942

    • SHA512

      09efae12fead3aac45e189c37b9d6dc6f301fbbd2449aba96512f4a4569b6fb43f3f032ff0fe30579e4e4032d0764b2f0b36b930d3758a5aa721191dbc2942c0

    • SSDEEP

      49152:DQU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4Bve4qfn8+nFFQCxEsJwKQp:DfaNQh+NUABO/c0Y9AdI4qf8+gqJW

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Danabot Loader Component

    • Danabot family

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks