General

  • Target

    2aa95ddd3b4935500faba54ac838463abb925a6e4101974f1dc09ae9e4ce1a99.exe

  • Size

    1.3MB

  • Sample

    241123-btcp7atrey

  • MD5

    59d3c2144026ed0691bed706e0ffa304

  • SHA1

    b335a87081f119ff1996f29e6a8c6c3fef0bc9bc

  • SHA256

    2aa95ddd3b4935500faba54ac838463abb925a6e4101974f1dc09ae9e4ce1a99

  • SHA512

    494989c98373f27a775269bde5e2b9c46bc33b9e247a48ebef397cd781b87b0fd5d7e28bf27eba2d6e6301fe382b54b95af3f7080dd202613a1c08879a0fe191

  • SSDEEP

    24576:qncFdcHdOgxk3F8TGFnnH0vySpIfAls7JHTUqqZm1i:hcEHn9IIfbRTRKmA

Malware Config

Extracted

Family

danabot

Botnet

4

C2

192.119.110.73:443

192.236.147.159:443

192.210.222.88:443

Attributes
  • embedded_hash

    F4711E27D559B4AEB1A081A1EB0AC465

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      2aa95ddd3b4935500faba54ac838463abb925a6e4101974f1dc09ae9e4ce1a99.exe

    • Size

      1.3MB

    • MD5

      59d3c2144026ed0691bed706e0ffa304

    • SHA1

      b335a87081f119ff1996f29e6a8c6c3fef0bc9bc

    • SHA256

      2aa95ddd3b4935500faba54ac838463abb925a6e4101974f1dc09ae9e4ce1a99

    • SHA512

      494989c98373f27a775269bde5e2b9c46bc33b9e247a48ebef397cd781b87b0fd5d7e28bf27eba2d6e6301fe382b54b95af3f7080dd202613a1c08879a0fe191

    • SSDEEP

      24576:qncFdcHdOgxk3F8TGFnnH0vySpIfAls7JHTUqqZm1i:hcEHn9IIfbRTRKmA

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Danabot Loader Component

    • Danabot family

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks