danabot

General

Target
file.exe
Size 142KB
Sample220930-srcqvadhh2
SHA256 d61bff5e6befd407a3e15702bbf4482609ce8b3ccf8025bc8ddf3c4e02a78d58
MD5 c83100364e6ff2448191604536f850b6
SHA1 e1fbf3af50157a965c184ffa2732a2cdc4440359
SHA512 0cd96e4b00c1239c28f58cde34319bb90bb94ca02b48ce80cdf1b44c4a475b0bebdc90d09551dd93daa79d606952ec588769c8d8634ab03a5caa0bf0f82cf55d
SSDEEP 3072:PRJUg4MZo7GRyJBc6O4USQmg5KdJJ1rHZAgvmrflEx:kMZotJBcB4USQmg58pJvDx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

danabot

Attributes

embedded_hash
A813CAF845B5703DA814AF785BB60B21
type
loader

Targets

- Target
  file.exe
- Size 142KB
- SHA256 d61bff5e6befd407a3e15702bbf4482609ce8b3ccf8025bc8ddf3c4e02a78d58
- MD5 c83100364e6ff2448191604536f850b6
- SHA1 e1fbf3af50157a965c184ffa2732a2cdc4440359
- SHA512 0cd96e4b00c1239c28f58cde34319bb90bb94ca02b48ce80cdf1b44c4a475b0bebdc90d09551dd93daa79d606952ec588769c8d8634ab03a5caa0bf0f82cf55d
- SSDEEP 3072:PRJUg4MZo7GRyJBc6O4USQmg5KdJJ1rHZAgvmrflEx:kMZotJBcB4USQmg58pJvDx
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

smokeloader backdoor trojan danabot banker
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects Smokeloader packer

SmokeLoader

Downloads MZ/PE file

Executes dropped EXE

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2