General
-
Target
d28c366c62912ca4b55d6ba946406e9cc816a342b3d8589dd22f7d82be5e8b0b
-
Size
202KB
-
Sample
220925-hse79adff6
-
MD5
a8e109dca22ca4763a44b6bf12963d7c
-
SHA1
9f36511f881b63770502a6bbf8ef5afca5d05cee
-
SHA256
d28c366c62912ca4b55d6ba946406e9cc816a342b3d8589dd22f7d82be5e8b0b
-
SHA512
e424c173e2c9198c18693fe848127ababa2c62b88a3ee6ac8a8056c8198306973cd51ffe5e10e949fa1f7adc013395bd141f26b408f786080934d353888fc483
-
SSDEEP
3072:5oFMJL840gVN5js4V67moeXSwfanofXBuH+ESb/PkIXx:9L+gU7mtxfAeE
Static task
static1
Behavioral task
behavioral1
Sample
d28c366c62912ca4b55d6ba946406e9cc816a342b3d8589dd22f7d82be5e8b0b.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
danabot
198.15.112.179:443
185.62.56.245:443
153.92.223.225:443
192.119.70.159:443
49.0.50.0:57
51.0.52.0:0
53.0.54.0:1200
55.0.56.0:65535
-
embedded_hash
6618C163D57D6441FCCA65D86C4D380D
-
type
loader
Targets
-
-
Target
d28c366c62912ca4b55d6ba946406e9cc816a342b3d8589dd22f7d82be5e8b0b
-
Size
202KB
-
MD5
a8e109dca22ca4763a44b6bf12963d7c
-
SHA1
9f36511f881b63770502a6bbf8ef5afca5d05cee
-
SHA256
d28c366c62912ca4b55d6ba946406e9cc816a342b3d8589dd22f7d82be5e8b0b
-
SHA512
e424c173e2c9198c18693fe848127ababa2c62b88a3ee6ac8a8056c8198306973cd51ffe5e10e949fa1f7adc013395bd141f26b408f786080934d353888fc483
-
SSDEEP
3072:5oFMJL840gVN5js4V67moeXSwfanofXBuH+ESb/PkIXx:9L+gU7mtxfAeE
Score10/10-
Detects Smokeloader packer
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-