General
-
Target
4c1726137e76add925cc8d3b1f9e2e140b3c0d0fb6f77b2e27562d85e8e77a21
-
Size
171KB
-
Sample
220926-d2axnshbh7
-
MD5
8d6efe332c8dd7e98f5ac5679488a231
-
SHA1
73dc9e2a95fca06d8ee4d3d5d56321e9aa7ac886
-
SHA256
4c1726137e76add925cc8d3b1f9e2e140b3c0d0fb6f77b2e27562d85e8e77a21
-
SHA512
58d1ef959005c7ceeaba3c09c4ae4751fb4c45696c189c2304b28e3d6c2bea902e34416046d6a762e08fd79adbf91678345f2e09a27501a22e5c7537c341fc00
-
SSDEEP
3072:UH+ZrT7UM8S35qMtlz6eGqZ5jJS2kXf9FcGDBGnogj5x:xcMzSgjuXfr
Static task
static1
Malware Config
Extracted
danabot
198.15.112.179:443
185.62.56.245:443
153.92.223.225:443
192.119.70.159:443
-
embedded_hash
6618C163D57D6441FCCA65D86C4D380D
-
type
loader
Targets
-
-
Target
4c1726137e76add925cc8d3b1f9e2e140b3c0d0fb6f77b2e27562d85e8e77a21
-
Size
171KB
-
MD5
8d6efe332c8dd7e98f5ac5679488a231
-
SHA1
73dc9e2a95fca06d8ee4d3d5d56321e9aa7ac886
-
SHA256
4c1726137e76add925cc8d3b1f9e2e140b3c0d0fb6f77b2e27562d85e8e77a21
-
SHA512
58d1ef959005c7ceeaba3c09c4ae4751fb4c45696c189c2304b28e3d6c2bea902e34416046d6a762e08fd79adbf91678345f2e09a27501a22e5c7537c341fc00
-
SSDEEP
3072:UH+ZrT7UM8S35qMtlz6eGqZ5jJS2kXf9FcGDBGnogj5x:xcMzSgjuXfr
-
Detects Smokeloader packer
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-