General

  • Target

    7179C889693EBCF568817EDF1D7C51EB.dll

  • Size

    1.3MB

  • Sample

    250117-h6nfsawnev

  • MD5

    7179c889693ebcf568817edf1d7c51eb

  • SHA1

    3bf39b6388d3d9038921f737693d6b9f03a0d91c

  • SHA256

    25f2a16ce6465a4bc51915930d848c6099068dbf883425f7fbdaf0b95c37237b

  • SHA512

    e68bff84c933820841064fe97db1146f88da22bd9ce40b42d0819c4f2fc9c3e5a32a6611bb462b2b599d19b64d1871ce63914f8de4fdb72ac315f36d4ff05a20

  • SSDEEP

    24576:XcF2B2LzFQT+F+A+Ow1AGfXrgIMeZjmgTQ97dv:s8zyAiK7tTZygTO7d

Malware Config

Extracted

Family

danabot

Botnet

4

C2

142.11.192.232:443

192.119.110.73:443

142.11.242.31:443

192.210.222.88:443

Attributes
  • embedded_hash

    F4711E27D559B4AEB1A081A1EB0AC465

  • type

    loader

rsa_pubkey.plain
rsa_privkey.plain

Targets

    • Target

      7179C889693EBCF568817EDF1D7C51EB.dll

    • Size

      1.3MB

    • MD5

      7179c889693ebcf568817edf1d7c51eb

    • SHA1

      3bf39b6388d3d9038921f737693d6b9f03a0d91c

    • SHA256

      25f2a16ce6465a4bc51915930d848c6099068dbf883425f7fbdaf0b95c37237b

    • SHA512

      e68bff84c933820841064fe97db1146f88da22bd9ce40b42d0819c4f2fc9c3e5a32a6611bb462b2b599d19b64d1871ce63914f8de4fdb72ac315f36d4ff05a20

    • SSDEEP

      24576:XcF2B2LzFQT+F+A+Ow1AGfXrgIMeZjmgTQ97dv:s8zyAiK7tTZygTO7d

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Danabot Loader Component

    • Danabot family

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks