Overview

overview

10

Static

static

3

JaffaCakes...6c.exe

windows7-x64

10

JaffaCakes...6c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_4f832af23cf6707b5fd6af2ec8e56b6c

  • Size

    1.2MB

  • Sample

    250101-k9pjcs1jb1

  • MD5

    4f832af23cf6707b5fd6af2ec8e56b6c

  • SHA1

    e8a0e3479a058c865af87bf0807b3866a5d44902

  • SHA256

    3e414a1e6b83292a1d78c827eec6e4befde73128f166803ca686fa7b063bb635

  • SHA512

    cbd34b3ccc8b0d26359ad91965362b87bc4cc518d14d8c6afcef7d8af43c9576d172672f88c4b8110fe5560ffdcd537a6f0385c3c43be43947e6f9b281558eca

  • SSDEEP

    24576:gto0dy9qVHElC25o+pRUzCMKguakpj4l4GlC/fjVOQW100kc6:gto0/pO1Ez8jppcl4GYZTW1R6

Score
10/10
danabot4bankerdiscoverytrojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

192.119.110.73:443

192.236.147.159:443

192.210.222.88:443
Attributes
  • embedded_hash

    F4711E27D559B4AEB1A081A1EB0AC465

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      JaffaCakes118_4f832af23cf6707b5fd6af2ec8e56b6c

    • Size

      1.2MB

    • MD5

      4f832af23cf6707b5fd6af2ec8e56b6c

    • SHA1

      e8a0e3479a058c865af87bf0807b3866a5d44902

    • SHA256

      3e414a1e6b83292a1d78c827eec6e4befde73128f166803ca686fa7b063bb635

    • SHA512

      cbd34b3ccc8b0d26359ad91965362b87bc4cc518d14d8c6afcef7d8af43c9576d172672f88c4b8110fe5560ffdcd537a6f0385c3c43be43947e6f9b281558eca

    • SSDEEP

      24576:gto0dy9qVHElC25o+pRUzCMKguakpj4l4GlC/fjVOQW100kc6:gto0/pO1Ez8jppcl4GYZTW1R6

    Score
    10/10
    danabot4bankerdiscoverytrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot Loader Component

    • Danabot family

      danabot

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks