General

  • Target

    1b31e4ea369ba979dd5b8716ee16a8b5cd03b49b.dll

  • Size

    1.9MB

  • Sample

    241119-n6cbea1jar

  • MD5

    da23fc5c0171fd94d8b08ebafcce50cd

  • SHA1

    1b31e4ea369ba979dd5b8716ee16a8b5cd03b49b

  • SHA256

    06adcafcee606bd684b5f3426a59ff57f436b5c908eceeb01258e5ad8b469de2

  • SHA512

    2e50510aa9692d552f28b3376503d674975a3643a383724a39f412b6968d6de5cd9e0148d6d133772d2f092f7f20be00a53837b815cb957406cce2408a22f6f8

  • SSDEEP

    49152:YQU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4Blemqfn8+nFFQCxEsJwKQX:YfaNQh+NUABO/c0Y9Ad2mqf8+gqJW

Malware Config

Extracted

Family

danabot

Botnet

40

C2

185.117.90.36:443

193.42.36.59:443

193.56.146.53:443

185.106.123.228:443

Attributes
  • embedded_hash

    07284E2A3AB3C2E1FFFBD425849BE150

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      1b31e4ea369ba979dd5b8716ee16a8b5cd03b49b.dll

    • Size

      1.9MB

    • MD5

      da23fc5c0171fd94d8b08ebafcce50cd

    • SHA1

      1b31e4ea369ba979dd5b8716ee16a8b5cd03b49b

    • SHA256

      06adcafcee606bd684b5f3426a59ff57f436b5c908eceeb01258e5ad8b469de2

    • SHA512

      2e50510aa9692d552f28b3376503d674975a3643a383724a39f412b6968d6de5cd9e0148d6d133772d2f092f7f20be00a53837b815cb957406cce2408a22f6f8

    • SSDEEP

      49152:YQU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4Blemqfn8+nFFQCxEsJwKQX:YfaNQh+NUABO/c0Y9Ad2mqf8+gqJW

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Danabot Loader Component

    • Danabot family

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks