General

  • Target

    e7c64e56b40db32181fd8b33a5516353_JaffaCakes118

  • Size

    1.3MB

  • Sample

    241212-xf6a8stjhw

  • MD5

    e7c64e56b40db32181fd8b33a5516353

  • SHA1

    3d48827f1003259b130289784145ed56ee05ff2d

  • SHA256

    bed8fab07f5f10f722de8485b38887176e656eb835c3d89df8ac8149f56c410d

  • SHA512

    baaa0e1ca97e7b7ea1dbcd2276e55836eeaac03049eb266f2dc500da477021c19097ebb3f5ebd4d9b9c930939a42a4da9b1bed70cc226e567c176b0249eb2372

  • SSDEEP

    24576:dcF2Qj8a9wWr6YjSPiNyHXWLlFePfgrB4zTndTqWKanot:e8OyHmL/uYrMTdT9q

Malware Config

Extracted

Family

danabot

Botnet

4

C2

23.254.144.209:443

192.236.194.86:443

142.11.192.232:443

Attributes
  • embedded_hash

    0E1A7A1479C37094441FA911262B322A

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      e7c64e56b40db32181fd8b33a5516353_JaffaCakes118

    • Size

      1.3MB

    • MD5

      e7c64e56b40db32181fd8b33a5516353

    • SHA1

      3d48827f1003259b130289784145ed56ee05ff2d

    • SHA256

      bed8fab07f5f10f722de8485b38887176e656eb835c3d89df8ac8149f56c410d

    • SHA512

      baaa0e1ca97e7b7ea1dbcd2276e55836eeaac03049eb266f2dc500da477021c19097ebb3f5ebd4d9b9c930939a42a4da9b1bed70cc226e567c176b0249eb2372

    • SSDEEP

      24576:dcF2Qj8a9wWr6YjSPiNyHXWLlFePfgrB4zTndTqWKanot:e8OyHmL/uYrMTdT9q

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Danabot Loader Component

    • Danabot family

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks