General

  • Target

    JaffaCakes118_c5f31fbc2722aecf08ec5a5746d75e8e

  • Size

    1.3MB

  • Sample

    250109-mjmyyszkck

  • MD5

    c5f31fbc2722aecf08ec5a5746d75e8e

  • SHA1

    5cd39b0dd0d341dcc1d30598e8681eb8cf47330d

  • SHA256

    0bbde7a5fa603e99d2fd18312481905786ac88021dcd8cc8b7784c547dfe3091

  • SHA512

    df3b78985c55fea2ec4d18e12429951274b5417ec34e3f7f88d60d01e6e6c7d1e2b05128a875d38d475f288fe6cb50b260ec3551c3cd2c4fa423ec1c8d36e29e

  • SSDEEP

    24576:f8pWEm1KueBa83J1p/moFwJPr2Fi58vq5RhlT5M65:0kmUMiWuTy6

Malware Config

Extracted

Family

danabot

Botnet

4

C2

192.119.110.73:443

192.236.147.159:443

192.210.222.88:443

Attributes
  • embedded_hash

    F4711E27D559B4AEB1A081A1EB0AC465

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      JaffaCakes118_c5f31fbc2722aecf08ec5a5746d75e8e

    • Size

      1.3MB

    • MD5

      c5f31fbc2722aecf08ec5a5746d75e8e

    • SHA1

      5cd39b0dd0d341dcc1d30598e8681eb8cf47330d

    • SHA256

      0bbde7a5fa603e99d2fd18312481905786ac88021dcd8cc8b7784c547dfe3091

    • SHA512

      df3b78985c55fea2ec4d18e12429951274b5417ec34e3f7f88d60d01e6e6c7d1e2b05128a875d38d475f288fe6cb50b260ec3551c3cd2c4fa423ec1c8d36e29e

    • SSDEEP

      24576:f8pWEm1KueBa83J1p/moFwJPr2Fi58vq5RhlT5M65:0kmUMiWuTy6

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Danabot Loader Component

    • Danabot family

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks