General

  • Target

    799865b39bb94b57c11e2f54cab257ca7d66551a7ac8fbe6195f57d5a91dd977.exe

  • Size

    1.3MB

  • Sample

    250116-em5zya1kfx

  • MD5

    998a0fb3ee130b8e1ecd29fdfae0f238

  • SHA1

    faf59274ef7c2a23a0f30b5554aa8c09e1232a44

  • SHA256

    799865b39bb94b57c11e2f54cab257ca7d66551a7ac8fbe6195f57d5a91dd977

  • SHA512

    316e55479b6dcf7f5704c7c8ba2c100ecb71396e86c1de6c474962ac5fbffad7a41523cf1d27e99033b3bc58d000bae3bf98a5d1fbddf2bccea28e135788aa65

  • SSDEEP

    24576:pbX7jHgZPGXo6M+QhlE5gp980MZAVsBgTlB47lH32Wq2tdMKeB1gSggIw0:pPbgZPGX/M+GCm8vrB5ZZYBIP

Malware Config

Extracted

Family

danabot

C2

53.128.18.18

98.171.58.197

192.71.249.51

225.74.56.39

37.65.171.19

112.253.42.12

176.177.153.116

15.154.247.162

151.236.14.84

140.90.53.163

rsa_pubkey.plain

Targets

    • Target

      799865b39bb94b57c11e2f54cab257ca7d66551a7ac8fbe6195f57d5a91dd977.exe

    • Size

      1.3MB

    • MD5

      998a0fb3ee130b8e1ecd29fdfae0f238

    • SHA1

      faf59274ef7c2a23a0f30b5554aa8c09e1232a44

    • SHA256

      799865b39bb94b57c11e2f54cab257ca7d66551a7ac8fbe6195f57d5a91dd977

    • SHA512

      316e55479b6dcf7f5704c7c8ba2c100ecb71396e86c1de6c474962ac5fbffad7a41523cf1d27e99033b3bc58d000bae3bf98a5d1fbddf2bccea28e135788aa65

    • SSDEEP

      24576:pbX7jHgZPGXo6M+QhlE5gp980MZAVsBgTlB47lH32Wq2tdMKeB1gSggIw0:pPbgZPGX/M+GCm8vrB5ZZYBIP

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Danabot family

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks