> For the complete documentation index, see [llms.txt](https://faresbltagy.gitbook.io/footprintinglabs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/danabot-lab.md). # DanaBot Lab Q1) What is the malicious file name used for initial access?
Answer: allegato\_708.js Q2) What is the sha256 hash of the file used for initial access? From this report:
Answer: 847b4ad90b1daba2d9117a8e05776f3f902dda593fb1252289538acf476c4268 Q3) What is the process used to execute the malicious file?
Answer: wscript.exe Q4) What is the extension of the second malicious file used by the attacker? ``` http ```
Answer: .dll Q5) What is the MD5 hash of the second malicious file? From File- -> Export Objects -> HTTP
```bash md5sum resources.dll ```
Answer: e758e07113016aca55d9eda2b0ffeebe Q6) What is the IP address used by the attacker in initial access? ``` tcp.flags.syn == 1 && tcp.flags.ack == 0 ```
Or from AnyRun:
Answer: 62.173.146.41 Q7) What is the last malicious IP address in the PCAP that is known to be used as CnC by DanaBot? ``` tcp.srcport != 433 ```
Answer: 91.201.67.85 --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://faresbltagy.gitbook.io/footprintinglabs/cyberdefenders/danabot-lab.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.