danabot

General

Target
file.exe
Size 142KB
Sample220930-nsvwlaedan
SHA256 5b7de919ed62842c19b188ae6a3f917a628efb2282831a3e0235bba7aab2999c
MD5 f721cd041409cbc09811c259a16fad84
SHA1 4d4cafe40f6456a3022efdb52a2564cee6ad83f4
SHA512 d0abd0165fedac6c546c2baff1c9580df1f2c4896bd667376fd03fcb5cff92d3b191bfe5737cecb9e90109096e4abb6b125336b83af0549bf645f069ac7aa7a5
SSDEEP 1536:4neBiUFEdTzhMh/H0MRp9BlqRVVqwshC2wdELM3MTMv1YH4XyMigUlJdMp/qfioI:8QiUmZkHlqR6vhC2wdtzw4Xy/X2q6o
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

danabot

Attributes

embedded_hash
A813CAF845B5703DA814AF785BB60B21
type
loader

Targets

- Target
  file.exe
- Size 142KB
- SHA256 5b7de919ed62842c19b188ae6a3f917a628efb2282831a3e0235bba7aab2999c
- MD5 f721cd041409cbc09811c259a16fad84
- SHA1 4d4cafe40f6456a3022efdb52a2564cee6ad83f4
- SHA512 d0abd0165fedac6c546c2baff1c9580df1f2c4896bd667376fd03fcb5cff92d3b191bfe5737cecb9e90109096e4abb6b125336b83af0549bf645f069ac7aa7a5
- SSDEEP 1536:4neBiUFEdTzhMh/H0MRp9BlqRVVqwshC2wdELM3MTMv1YH4XyMigUlJdMp/qfioI:8QiUmZkHlqR6vhC2wdtzw4Xy/X2q6o
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

smokeloader backdoor trojan danabot banker
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects Smokeloader packer

SmokeLoader

Downloads MZ/PE file

Executes dropped EXE

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2