danabot | 923e399c2cb7dca74941106c0c5b3f334e82617a230b1f754b53982db218ea6e

General

Target
2026-09-24_01c83de0c5179027625e8e8edf4e2f54_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop
Size 3.6MB
Sample260925-tkga5a114m
SHA256 923e399c2cb7dca74941106c0c5b3f334e82617a230b1f754b53982db218ea6e
MD5 01c83de0c5179027625e8e8edf4e2f54
SHA1 5a2321e13e4bfc99323f4510c9ed42820b1a4d87
SHA512 835b1da30117b37c0cf0d57d596f5950eb94e022ca1bb02200fe33b3175405bb483087006d8fd4a41fab6aaba7688c50b65e7816ab86614db70e33cfbdf5d190
SSDEEP 98304:nz3KQ5tuUwyusZ5BoMZzUPlMJNkIp7C9:TKQ5UyVJVZ+lMey29
TLSH
T1C1063360F2809035E2D35CB29810F44130FF276B65A457CF77AE6E6D4E306E9BEA6247
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

danabot

C2

104.234.239.223:443
104.234.119.237:443
104.156.149.14:443

Attributes

embedded_hash
BAFC81C25866FA9137E15DBAAA26BC59
type
loader

Targets

- Target
  2026-09-24_01c83de0c5179027625e8e8edf4e2f54_amadey_elex_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop
- Size 3.6MB
- SHA256 923e399c2cb7dca74941106c0c5b3f334e82617a230b1f754b53982db218ea6e
- MD5 01c83de0c5179027625e8e8edf4e2f54
- SHA1 5a2321e13e4bfc99323f4510c9ed42820b1a4d87
- SHA512 835b1da30117b37c0cf0d57d596f5950eb94e022ca1bb02200fe33b3175405bb483087006d8fd4a41fab6aaba7688c50b65e7816ab86614db70e33cfbdf5d190
- SSDEEP 98304:nz3KQ5tuUwyusZ5BoMZzUPlMJNkIp7C9:TKQ5UyVJVZ+lMey29
- TLSH
  T1C1063360F2809035E2D35CB29810F44130FF276B65A457CF77AE6E6D4E306E9BEA6247
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker discovery danabot trojan
- Family: Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Danabot

Badlisted process makes network request

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2