danabot

General

Target
file.exe
Size 133KB
Sample221003-dsgc4afcar
SHA256 877f9603ec6b9ef86afa8b245ba6e32f14276e71208b2ce1a490f9d43eef3a3d
MD5 884fa30623ab1d443f5173bd1c03ab1c
SHA1 13d647fc9bd9c61c1eda3cfa390b70277db1486e
SHA512 e215d3a1d80b34d863a241a8ad17c15cbb2331eaf0b4a877103d54c08b6fb60c2583dca03f91597bc6a8df57cdfd6dfc4baf566e0bad2f1391e84cc97f587d0e
SSDEEP 1536:nHRrVhQ1N4yORhKn1Kv3X6yghubAtr/UypLQWaXKReVaZ6QG1lZvrObyoYWlO:nHREDOR4n4FctjfQ9XmKIENpotlO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

danabot

C2

192.236.233.188:443
192.119.70.159:443
23.106.124.171:443

Attributes

embedded_hash
F11D3871631E16E8DE15C24B32328D98
type
loader

Targets

- Target
  file.exe
- Size 133KB
- SHA256 877f9603ec6b9ef86afa8b245ba6e32f14276e71208b2ce1a490f9d43eef3a3d
- MD5 884fa30623ab1d443f5173bd1c03ab1c
- SHA1 13d647fc9bd9c61c1eda3cfa390b70277db1486e
- SHA512 e215d3a1d80b34d863a241a8ad17c15cbb2331eaf0b4a877103d54c08b6fb60c2583dca03f91597bc6a8df57cdfd6dfc4baf566e0bad2f1391e84cc97f587d0e
- SSDEEP 1536:nHRrVhQ1N4yORhKn1Kv3X6yghubAtr/UypLQWaXKReVaZ6QG1lZvrObyoYWlO:nHREDOR4n4FctjfQ9XmKIENpotlO
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

smokeloader backdoor trojan danabot banker
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects Smokeloader packer

SmokeLoader

Downloads MZ/PE file

Executes dropped EXE

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2