Overview

overview

10

Static

static

3

JaffaCakes...de.exe

windows7-x64

10

JaffaCakes...de.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_a895be1b07e632fbee696735f801b9de

  • Size

    1.1MB

  • Sample

    250108-yggvpssrgr

  • MD5

    a895be1b07e632fbee696735f801b9de

  • SHA1

    a4291268441dfe73c396547b8df1911faf3ce0b3

  • SHA256

    d0851a56e4cb0f8ca022ccba8fa354acd3d503ea3605d615859c7ac6f9701983

  • SHA512

    5b729fcd4090d6c3a3ebbcc1db0531deb8df7eb73e4f28d31d7fedbdcb5341c3f6f66146fe4ee8f35c4b10a27172822a22acef3bad462f5197070ff8de57f48e

  • SSDEEP

    24576:j3B/Urs6o/+TznYNy8sBIbkFARX8yrFycO77hzppXgC/H8Wu:AL4NlsBIEAt88c7hzpRgC/pu

Score
10/10
danabot4bankerdiscoverytrojan

Malware Config

Extracted

Family

danabot

Botnet

4

C2

192.119.110.73:443

192.236.147.159:443

192.210.222.88:443
Attributes
  • embedded_hash

    F4711E27D559B4AEB1A081A1EB0AC465

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      JaffaCakes118_a895be1b07e632fbee696735f801b9de

    • Size

      1.1MB

    • MD5

      a895be1b07e632fbee696735f801b9de

    • SHA1

      a4291268441dfe73c396547b8df1911faf3ce0b3

    • SHA256

      d0851a56e4cb0f8ca022ccba8fa354acd3d503ea3605d615859c7ac6f9701983

    • SHA512

      5b729fcd4090d6c3a3ebbcc1db0531deb8df7eb73e4f28d31d7fedbdcb5341c3f6f66146fe4ee8f35c4b10a27172822a22acef3bad462f5197070ff8de57f48e

    • SSDEEP

      24576:j3B/Urs6o/+TznYNy8sBIbkFARX8yrFycO77hzppXgC/H8Wu:AL4NlsBIEAt88c7hzpRgC/pu

    Score
    10/10
    danabot4bankerdiscoverytrojan

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Danabot Loader Component

    • Danabot family

      danabot

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks