General

  • Target

    1f34ba3283da9ac68dc2d9200863b1c12114ee49c7ae65a989cd27d27b0ee1a5.exe

  • Size

    1.9MB

  • Sample

    241118-r4aataykhv

  • MD5

    bd7841ab0e4ae6accc7a33bfc58273c9

  • SHA1

    386d26492c6483e6cbe60c44a7015a95aa7506bb

  • SHA256

    1f34ba3283da9ac68dc2d9200863b1c12114ee49c7ae65a989cd27d27b0ee1a5

  • SHA512

    8121d8309c0b4ae0849002420578f2fd497a8490f57f0d16ed8b3d169a2576f47a56099ca5dead39db99387de5d06db69d4d1305121e895ae33b32e46982f5f5

  • SSDEEP

    49152:UQU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4BMesqfn8+nFFQCxEsJwKQdH:UfaNQh+NUABO/c0Y9AdVsqf8+gqJWF

Malware Config

Extracted

Family

danabot

Botnet

40

C2

185.117.90.36:443

193.42.36.59:443

193.56.146.53:443

185.106.123.228:443

Attributes
  • embedded_hash

    07284E2A3AB3C2E1FFFBD425849BE150

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      1f34ba3283da9ac68dc2d9200863b1c12114ee49c7ae65a989cd27d27b0ee1a5.exe

    • Size

      1.9MB

    • MD5

      bd7841ab0e4ae6accc7a33bfc58273c9

    • SHA1

      386d26492c6483e6cbe60c44a7015a95aa7506bb

    • SHA256

      1f34ba3283da9ac68dc2d9200863b1c12114ee49c7ae65a989cd27d27b0ee1a5

    • SHA512

      8121d8309c0b4ae0849002420578f2fd497a8490f57f0d16ed8b3d169a2576f47a56099ca5dead39db99387de5d06db69d4d1305121e895ae33b32e46982f5f5

    • SSDEEP

      49152:UQU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4BMesqfn8+nFFQCxEsJwKQdH:UfaNQh+NUABO/c0Y9AdVsqf8+gqJWF

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Danabot Loader Component

    • Danabot family

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks