danabot

General

Target
file.exe
Size 141KB
Sample220930-wzwepsfchq
SHA256 17762ce1a70033a8a2bdababbcfaba6baf0262f6d5ef7c2deb38d865bd9929af
MD5 7f440f8e5cb802ab3c2c1cce70b7dea0
SHA1 b1277e2305520e8a62e1ea2235adcd8cdca9b460
SHA512 0f34fbbfbd122c128155e1294ad05a14df72a02e87147f4bc7fd3e64406189995341536a81895cfe1fa8e141fb7b8acac92833d56465a7b294f0f6f4597e6dd8
SSDEEP 3072:FcuUUkv8qFGRfzJjUCp2tt+uGMhqz37mpjE1a:A8q6g+uGMi3Hk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

danabot

Attributes

embedded_hash
A813CAF845B5703DA814AF785BB60B21
type
loader

Targets

- Target
  file.exe
- Size 141KB
- SHA256 17762ce1a70033a8a2bdababbcfaba6baf0262f6d5ef7c2deb38d865bd9929af
- MD5 7f440f8e5cb802ab3c2c1cce70b7dea0
- SHA1 b1277e2305520e8a62e1ea2235adcd8cdca9b460
- SHA512 0f34fbbfbd122c128155e1294ad05a14df72a02e87147f4bc7fd3e64406189995341536a81895cfe1fa8e141fb7b8acac92833d56465a7b294f0f6f4597e6dd8
- SSDEEP 3072:FcuUUkv8qFGRfzJjUCp2tt+uGMhqz37mpjE1a:A8q6g+uGMi3Hk
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

smokeloader backdoor trojan danabot banker
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects Smokeloader packer

SmokeLoader

Downloads MZ/PE file

Executes dropped EXE

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2