danabot

General

Target
file.exe
Size 133KB
Sample221002-w92pgafdg6
SHA256 73ea8bc1ce6d229ceb703c4f756bb61fb8268ff0e0929bda62b2eefde62719d5
MD5 6396bdcdcc0b0c3f24e19a16fa16d617
SHA1 aa3a5c6764efdf09b640470a959e0a8bb63adee9
SHA512 24a171357e311aa490ebf1b0ee2b3d534fd0c50680e4574ed133acdf87eb1cdb2f0f52241bd98b6012b63ab3aa556605226f522bd91c5049e7c14e631a602e42
SSDEEP 3072:nf3S5ORlIySUJwrhqeZ17QXpT+zVb6VFrZzfG:a2IySPweZMpTw6Vbzf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

danabot

Attributes

embedded_hash
F11D3871631E16E8DE15C24B32328D98
type
loader

Targets

- Target
  file.exe
- Size 133KB
- SHA256 73ea8bc1ce6d229ceb703c4f756bb61fb8268ff0e0929bda62b2eefde62719d5
- MD5 6396bdcdcc0b0c3f24e19a16fa16d617
- SHA1 aa3a5c6764efdf09b640470a959e0a8bb63adee9
- SHA512 24a171357e311aa490ebf1b0ee2b3d534fd0c50680e4574ed133acdf87eb1cdb2f0f52241bd98b6012b63ab3aa556605226f522bd91c5049e7c14e631a602e42
- SSDEEP 3072:nf3S5ORlIySUJwrhqeZ17QXpT+zVb6VFrZzfG:a2IySPweZMpTw6Vbzf
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

smokeloader backdoor trojan danabot banker
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects Smokeloader packer

SmokeLoader

Downloads MZ/PE file

Executes dropped EXE

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2