General

  • Target

    7f87c8327acfc6ca350781a2ec84254eb5e759fc83a65dd13db2cbdca44d6165N.exe

  • Size

    4.3MB

  • Sample

    241130-2wfsqsxras

  • MD5

    973b3f23a7dc1a79c5a1d63941a1cbd0

  • SHA1

    0644bb719b3a2a64c32a8096de47f0305d7b11fe

  • SHA256

    7f87c8327acfc6ca350781a2ec84254eb5e759fc83a65dd13db2cbdca44d6165

  • SHA512

    0a13d6dfbc4fdd330ce67217bb92ad68e283912c298f624c4be258a867c490afe4da267fb986be281749c6e111bfbf9473daa9d097f1f13b75d70fe4df93ce07

  • SSDEEP

    49152:qMpitQoS/YAgJUCwC4PH2DIi4UtrXnQ7cf0ju5WSLqvezCnKaqlrDTk95XeDP:7stQoS/YPfn4PWUctrQ7cf0jRDWreX

Malware Config

Extracted

Family

danabot

C2

104.234.239.223:443

104.234.119.237:443

104.156.149.14:443

104.234.119.246:443

Attributes
  • type

    loader

Targets

    • Target

      7f87c8327acfc6ca350781a2ec84254eb5e759fc83a65dd13db2cbdca44d6165N.exe

    • Size

      4.3MB

    • MD5

      973b3f23a7dc1a79c5a1d63941a1cbd0

    • SHA1

      0644bb719b3a2a64c32a8096de47f0305d7b11fe

    • SHA256

      7f87c8327acfc6ca350781a2ec84254eb5e759fc83a65dd13db2cbdca44d6165

    • SHA512

      0a13d6dfbc4fdd330ce67217bb92ad68e283912c298f624c4be258a867c490afe4da267fb986be281749c6e111bfbf9473daa9d097f1f13b75d70fe4df93ce07

    • SSDEEP

      49152:qMpitQoS/YAgJUCwC4PH2DIi4UtrXnQ7cf0ju5WSLqvezCnKaqlrDTk95XeDP:7stQoS/YPfn4PWUctrQ7cf0jRDWreX

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Danabot family

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks