danabot

General

Target

1b6d955b893be0e5bbd2e79407b90dee4e9277a87eb303c3e123dc5fd93f8001.exe
Size

1.3MB
Sample

241124-gkv33asrdl
MD5

08077c0cbc7bbe2320b1d07a9cd475ab
SHA1

273ea1d057e4bfb80849ff53aa948ed7ed08fb17
SHA256

1b6d955b893be0e5bbd2e79407b90dee4e9277a87eb303c3e123dc5fd93f8001
SHA512

9ecf36bd8d47b5357ef63a95e8a3a3195ca2401c5923d343dba0c34ec0f1bcdd7ad0fdc5e845dd558758ec6ae3492d7b196272aef3b13fd416fb01492c9c6f17
SSDEEP

24576:58FG/L98qXKTVfl8B0Y1ewAfj3xCV2D3qyzITrQB79te:a7VSNAfj3xCoayzIT0je

Score

10^/10

Malware Config

Extracted

Family

danabot

Botnet

4

C2

192.119.110.73:443

192.236.147.159:443

192.210.222.88:443

Attributes

embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
type
loader

rsa_pubkey.plain

1
-----BEGIN PUBLIC KEY-----
2
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPvYED31s9p4zf6GMtg/u+PcE3
3
nZfynudhDfv9UkUfPbos2SlZ26IDACG5/jQNYcToWrfJiUO9rHtvi2OvyMM0sHdJ
4
KQVRs5DsWW+z2cSr3feptw4M2MoUKzr9hDPum7mJDoHCnp1QQ88CXGRFUkIgeDWQ
5
xtcCtZrs2sSQRqUMiwIDAQAB
6
-----END PUBLIC KEY-----

rsa_privkey.plain

1

-----BEGIN PRIVATE KEY-----

2

MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAOOm9k+ryXXerM68

3

3MtZ9iYTNyuRgucSqPY6lE/MXd+yHzKDr/WATSQNCWHyU0vm06l6EojeRy2n/34t

4

g7HMf0bs8WdlZE4TZ91//IKYaD3MrU/K6vPCzNJ0koNPb1fYQRjQ48pZvJjekgJ9

5

OWhXoYgdzVvNFQrLJ7gYBKHLNXKVAgMBAAECgYA1gEWez7aW9vAR3hzdxZStuhJb

6

MOVcvOvsgjPc1SCys7/VNVGjFrYKZO3xkOu2iNbxm3jDpcmAl1zaIIQ0wuSeKu+d

7

M+nlRvEv92bvMt77h/71VRYK/634+DngV7N8fkWTpHgBAy1sjRZv126PV4joEL2L

8

h8sJRWeTHmrWqE5BuQJBAP3xg8DF0jJHQt+0YLGFndMxhJyHx76G9Qo3k5Sdrt5g

9

vH/DeZgXXWjkWcU3zZ+aHkXVD2UQfvUY+5zctaJrmE8CQQDlfvCEBfKkBSFyl3je

10

Ci09Fy4TozqMWe67QNTo/t3V6CyL+KHytDqnQnhR6X2hUfueGe9wL5xZrv1FTc0P

Targets

- Target
  
  1b6d955b893be0e5bbd2e79407b90dee4e9277a87eb303c3e123dc5fd93f8001.exe
- Size
  
  1.3MB
- MD5
  
  08077c0cbc7bbe2320b1d07a9cd475ab
- SHA1
  
  273ea1d057e4bfb80849ff53aa948ed7ed08fb17
- SHA256
  
  1b6d955b893be0e5bbd2e79407b90dee4e9277a87eb303c3e123dc5fd93f8001
- SHA512
  
  9ecf36bd8d47b5357ef63a95e8a3a3195ca2401c5923d343dba0c34ec0f1bcdd7ad0fdc5e845dd558758ec6ae3492d7b196272aef3b13fd416fb01492c9c6f17
- SSDEEP
  
  24576:58FG/L98qXKTVfl8B0Y1ewAfj3xCV2D3qyzITrQB79te:a7VSNAfj3xCoayzIT0je
Score

10^/10

danabot 4 banker discovery trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Danabot Loader Component
- Danabot family
  danabot
- Blocklisted process makes network request
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Danabot Loader Component

Danabot family

Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

We care about your privacy.