danabot

General

Target
file.exe
Size 317KB
Sample220927-gjls1acfe6
SHA256 070ea70d8dcebd3f601ffc189a2911e95bcff087e4b8ef96f5ce5636885408df
MD5 b269b15199b8d0670877419c9e804211
SHA1 aca68aaaa3232feb0f7de714d8bb18e22230974b
SHA512 8889810e65ebeff6d2d0f65b0fe966fe34fc40faa29ca81a09372b14af4f535f5c5a12bc6524ccfb2ee93ae990fe3fe0229fbac3065aa402c63ec91b8f4464e8
SSDEEP 6144:4zm3OC0me5g4BKxwJUapE801VlnigabwVf:4z4Oeq0C7u1Vli
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

danabot

Attributes

embedded_hash
6618C163D57D6441FCCA65D86C4D380D
type
loader

Targets

- Target
  file.exe
- Size 317KB
- SHA256 070ea70d8dcebd3f601ffc189a2911e95bcff087e4b8ef96f5ce5636885408df
- MD5 b269b15199b8d0670877419c9e804211
- SHA1 aca68aaaa3232feb0f7de714d8bb18e22230974b
- SHA512 8889810e65ebeff6d2d0f65b0fe966fe34fc40faa29ca81a09372b14af4f535f5c5a12bc6524ccfb2ee93ae990fe3fe0229fbac3065aa402c63ec91b8f4464e8
- SSDEEP 6144:4zm3OC0me5g4BKxwJUapE801VlnigabwVf:4z4Oeq0C7u1Vli
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

smokeloader backdoor trojan danabot banker
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects Smokeloader packer

SmokeLoader

Downloads MZ/PE file

Executes dropped EXE

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2