danabot | 74011a1f131dc3be8664744651bafe8ace0d86755f8d77f9b917e200476b2d94 | Triage

Sharing

General

Target

2552-5-0x0000000002330000-0x0000000002524000-memory.dmp
Size

2.0MB
Sample

241119-pvgbnawjgv
MD5

b643d379b41b794902e6d5fb0dd07747
SHA1

5bc82b6ec781a3262b15db9296d6d25ca11fb8ef
SHA256

74011a1f131dc3be8664744651bafe8ace0d86755f8d77f9b917e200476b2d94
SHA512

ffef5391ef973c247b0702a11b32b7b7d6afed8a4c09ee5dd4d79a781cca4907edf916c0969543c27beb365be5b68721a0a01602b720413990ded029477546a9
SSDEEP

49152:CvBBwmwF/IhWT//+Eqqfn8+nFFQCxEsJwKQv:CvBBwmwF/IBEqqf8+gqJW

Score

10^/10

danabot 40 discovery

Malware Config

Extracted

Family

danabot

Botnet

40

C2

185.117.90.36:443

193.42.36.59:443

193.56.146.53:443

185.106.123.228:443

Attributes

embedded_hash
07284E2A3AB3C2E1FFFBD425849BE150
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Targets

- Target
  
  2552-5-0x0000000002330000-0x0000000002524000-memory.dmp
- Size
  
  2.0MB
- MD5
  
  b643d379b41b794902e6d5fb0dd07747
- SHA1
  
  5bc82b6ec781a3262b15db9296d6d25ca11fb8ef
- SHA256
  
  74011a1f131dc3be8664744651bafe8ace0d86755f8d77f9b917e200476b2d94
- SHA512
  
  ffef5391ef973c247b0702a11b32b7b7d6afed8a4c09ee5dd4d79a781cca4907edf916c0969543c27beb365be5b68721a0a01602b720413990ded029477546a9
- SSDEEP
  
  49152:CvBBwmwF/IhWT//+Eqqfn8+nFFQCxEsJwKQv:CvBBwmwF/IBEqqf8+gqJW
Score

3^/10

discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2