danabot | d5cde707cc31c891dc3ca93a6d078fd1fd5e7bb897c07e10c240f0e1aa9c293d | Triage

Submit
Reports

Overview

overview

Static

static

3

d5cde707cc...3d.dll

windows7-x64

d5cde707cc...3d.dll

windows10-2004-x64

Sharing

General

Target

d5cde707cc31c891dc3ca93a6d078fd1fd5e7bb897c07e10c240f0e1aa9c293d
Size

1.9MB
Sample

241120-knyvxatgke
MD5

536eb8b12cdd42a048f1af293ffbd706
SHA1

0fbc3b782c15c2c091a8706e5e6ce7f4887727d8
SHA256

d5cde707cc31c891dc3ca93a6d078fd1fd5e7bb897c07e10c240f0e1aa9c293d
SHA512

da8c958e50e879db0753a489f7ec437ec41c26d257e78365bd9c4c3d0c87afc75aa1b2efe9220f13755c2b39946620d3a52fd60d3a8fc9cc875cc7a05560c473
SSDEEP

49152:8QU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4B0eZqfn8+nFFQCxEsJwKQG:8faNQh+NUABO/c0Y9Ad1Zqf8+gqJW

Score

10^/10

danabot 40 banker discovery trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

d5cde707cc31c891dc3ca93a6d078fd1fd5e7bb897c07e10c240f0e1aa9c293d.dll

Resource

win7-20240903-en

danabot 40 banker discovery trojan

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

d5cde707cc31c891dc3ca93a6d078fd1fd5e7bb897c07e10c240f0e1aa9c293d.dll

Resource

win10v2004-20241007-en

danabot 40 banker discovery trojan

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Extracted

Family

danabot

Botnet

40

C2

185.117.90.36:443

193.42.36.59:443

193.56.146.53:443

185.106.123.228:443

Attributes

embedded_hash
07284E2A3AB3C2E1FFFBD425849BE150
type
loader

rsa_pubkey.plain

rsa_privkey.plain

Targets

- Target
  
  d5cde707cc31c891dc3ca93a6d078fd1fd5e7bb897c07e10c240f0e1aa9c293d
- Size
  
  1.9MB
- MD5
  
  536eb8b12cdd42a048f1af293ffbd706
- SHA1
  
  0fbc3b782c15c2c091a8706e5e6ce7f4887727d8
- SHA256
  
  d5cde707cc31c891dc3ca93a6d078fd1fd5e7bb897c07e10c240f0e1aa9c293d
- SHA512
  
  da8c958e50e879db0753a489f7ec437ec41c26d257e78365bd9c4c3d0c87afc75aa1b2efe9220f13755c2b39946620d3a52fd60d3a8fc9cc875cc7a05560c473
- SSDEEP
  
  49152:8QU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4B0eZqfn8+nFFQCxEsJwKQG:8faNQh+NUABO/c0Y9Ad1Zqf8+gqJW
Score

10^/10

danabot 40 banker discovery trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Danabot Loader Component
- Danabot family
  danabot
- Blocklisted process makes network request
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

danabot40bankerdiscoverytrojan

behavioral2

danabot40bankerdiscoverytrojan

© 2018-2024

Terms | Privacy