General

  • Target

    JaffaCakes118_2b6e4215fc2243cc728bc82781b8110f520e470e35517b37e8b52a7f09834eb3

  • Size

    1.3MB

  • Sample

    241222-gzw9nsxjcz

  • MD5

    99cd1ad49f250d09bbd2bfb4e54c32e0

  • SHA1

    57b56312ee2a129a41a14aba9828241abb5c5e71

  • SHA256

    2b6e4215fc2243cc728bc82781b8110f520e470e35517b37e8b52a7f09834eb3

  • SHA512

    6929071012bcab9e8531670efa2b632377d7d37a1dbc362ba2281fbd046a04f12d23e0dd51bea8369bfe30cd2a10730f7ee2c333d22494b78df22615c5ca84f3

  • SSDEEP

    24576:oSegMr+9G3hr+WKLtHs9oHAkrjJwWtOGgAcEndVjCnghKpv6su:oSa+mrcZgeK4g+j+UKpTu

Malware Config

Extracted

Family

danabot

C2

192.236.233.188:443

192.119.70.159:443

23.106.124.171:443

213.227.155.103:443

Attributes
  • embedded_hash

    56951C922035D696BFCE443750496462

  • type

    loader

Targets

    • Target

      JaffaCakes118_2b6e4215fc2243cc728bc82781b8110f520e470e35517b37e8b52a7f09834eb3

    • Size

      1.3MB

    • MD5

      99cd1ad49f250d09bbd2bfb4e54c32e0

    • SHA1

      57b56312ee2a129a41a14aba9828241abb5c5e71

    • SHA256

      2b6e4215fc2243cc728bc82781b8110f520e470e35517b37e8b52a7f09834eb3

    • SHA512

      6929071012bcab9e8531670efa2b632377d7d37a1dbc362ba2281fbd046a04f12d23e0dd51bea8369bfe30cd2a10730f7ee2c333d22494b78df22615c5ca84f3

    • SSDEEP

      24576:oSegMr+9G3hr+WKLtHs9oHAkrjJwWtOGgAcEndVjCnghKpv6su:oSa+mrcZgeK4g+j+UKpTu

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Danabot family

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks