General

  • Target

    de158e86683f201a2c8e54cfa6cfb8479b9876a097141912937f32908975f324N.exe

  • Size

    1.3MB

  • Sample

    250117-sjxq2stmej

  • MD5

    80ac174a24937baf8bb3fdd781ca8c50

  • SHA1

    5592c616f56827bceea0ba74147d03b6b3dbd1a7

  • SHA256

    de158e86683f201a2c8e54cfa6cfb8479b9876a097141912937f32908975f324

  • SHA512

    46620a5bfeeefcbc1a2bc445104c0e536756d5f82ecd7a5ba4af0d7b61e8a4893a38c8f30e3c3f2a1396a8b00c9028888ca02b99cb988880f72c957882750ac2

  • SSDEEP

    24576:pbX7jHgZPGXo6M+QhlE5gp980MZAVsBgTlB47lH32Wq2tdMKeB1gSggIw:pPbgZPGX/M+GCm8vrB5ZZYBI

Malware Config

Extracted

Family

danabot

C2

53.128.18.18

98.171.58.197

192.71.249.51

225.74.56.39

37.65.171.19

112.253.42.12

176.177.153.116

15.154.247.162

151.236.14.84

140.90.53.163

rsa_pubkey.plain

Targets

    • Target

      de158e86683f201a2c8e54cfa6cfb8479b9876a097141912937f32908975f324N.exe

    • Size

      1.3MB

    • MD5

      80ac174a24937baf8bb3fdd781ca8c50

    • SHA1

      5592c616f56827bceea0ba74147d03b6b3dbd1a7

    • SHA256

      de158e86683f201a2c8e54cfa6cfb8479b9876a097141912937f32908975f324

    • SHA512

      46620a5bfeeefcbc1a2bc445104c0e536756d5f82ecd7a5ba4af0d7b61e8a4893a38c8f30e3c3f2a1396a8b00c9028888ca02b99cb988880f72c957882750ac2

    • SSDEEP

      24576:pbX7jHgZPGXo6M+QhlE5gp980MZAVsBgTlB47lH32Wq2tdMKeB1gSggIw:pPbgZPGX/M+GCm8vrB5ZZYBI

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Danabot family

    • Blocklisted process makes network request

MITRE ATT&CK Enterprise v15

Tasks