Overview

overview

10

Static

static

3

JaffaCakes...d2.exe

windows7-x64

10

JaffaCakes...d2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_ef7a72fa078f02a16388b6226e3fb026542662c1ee0dc5d8e4552a44dd4e61d2

  • Size

    1.2MB

  • Sample

    241230-gkxlwszpck

  • MD5

    5b48238ab8b671f041e3731ca016318e

  • SHA1

    8ca4f3b35bc3fd3aa7816d5243bb9e85635f3d90

  • SHA256

    ef7a72fa078f02a16388b6226e3fb026542662c1ee0dc5d8e4552a44dd4e61d2

  • SHA512

    1f1551f0519572b3c5aafa9df9e6d3b48342fc1071b3d80db6e43204d50aacd97bb914e799ddca137a78e3623fe04703cd9a2c83eb2791d3d145d0a45cd69540

  • SSDEEP

    24576:oUBYynxJQWdihbtokHwX+dxXE9ABpsDW8G3pIdy3wlkRWX:7/UWCBW+ddXfDTqymk

Score
10/10
danabotbankerdiscoverytrojan

Malware Config

Extracted

Family

danabot

C2

198.15.112.179:443

185.62.56.245:443

153.92.223.225:443

192.119.70.159:443
Attributes
  • embedded_hash

    6618C163D57D6441FCCA65D86C4D380D

  • type

    loader

Targets

    • Target

      JaffaCakes118_ef7a72fa078f02a16388b6226e3fb026542662c1ee0dc5d8e4552a44dd4e61d2

    • Size

      1.2MB

    • MD5

      5b48238ab8b671f041e3731ca016318e

    • SHA1

      8ca4f3b35bc3fd3aa7816d5243bb9e85635f3d90

    • SHA256

      ef7a72fa078f02a16388b6226e3fb026542662c1ee0dc5d8e4552a44dd4e61d2

    • SHA512

      1f1551f0519572b3c5aafa9df9e6d3b48342fc1071b3d80db6e43204d50aacd97bb914e799ddca137a78e3623fe04703cd9a2c83eb2791d3d145d0a45cd69540

    • SSDEEP

      24576:oUBYynxJQWdihbtokHwX+dxXE9ABpsDW8G3pIdy3wlkRWX:7/UWCBW+ddXfDTqymk

    Score
    10/10
    danabotbankerdiscoverytrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot family

      danabot

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks