General

  • Target

    8708a256d09ca02b886e7c90f38b8d8f392b21b7b2941c09992adb5c1ae7ed0d

  • Size

    1.9MB

  • Sample

    241114-3w34psvhjk

  • MD5

    32ea1e434879bd24a6f4d39c997aa10f

  • SHA1

    0c8c0afb879c95af9f771fc8b50897f3410a7274

  • SHA256

    8708a256d09ca02b886e7c90f38b8d8f392b21b7b2941c09992adb5c1ae7ed0d

  • SHA512

    70d139abd902134a948131d68336779b5b2c41ae8690b41e563f426fd3de95255a9cbb7758745b8bc104f32454f5f5c3f514beea67f4be2e47b29be3c64a0f49

  • SSDEEP

    49152:IQU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4Bzetqfn8+nFFQCxEsJwKQG:IfaNQh+NUABO/c0Y9Adktqf8+gqJW

Malware Config

Extracted

Family

danabot

Botnet

40

C2

185.117.90.36:443

193.42.36.59:443

193.56.146.53:443

185.106.123.228:443

Attributes
  • embedded_hash

    07284E2A3AB3C2E1FFFBD425849BE150

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      8708a256d09ca02b886e7c90f38b8d8f392b21b7b2941c09992adb5c1ae7ed0d

    • Size

      1.9MB

    • MD5

      32ea1e434879bd24a6f4d39c997aa10f

    • SHA1

      0c8c0afb879c95af9f771fc8b50897f3410a7274

    • SHA256

      8708a256d09ca02b886e7c90f38b8d8f392b21b7b2941c09992adb5c1ae7ed0d

    • SHA512

      70d139abd902134a948131d68336779b5b2c41ae8690b41e563f426fd3de95255a9cbb7758745b8bc104f32454f5f5c3f514beea67f4be2e47b29be3c64a0f49

    • SSDEEP

      49152:IQU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4Bzetqfn8+nFFQCxEsJwKQG:IfaNQh+NUABO/c0Y9Adktqf8+gqJW

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Danabot Loader Component

    • Danabot family

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks