danabot

General

Target
file.exe
Size 133KB
Sample221003-j1j2vaedh2
SHA256 3d9dbb946b996fcaa77c720d34d651eacea52c92c97ef584aa32baeaa958a29d
MD5 1d5f250555d810f4659a579027fa9323
SHA1 a330193d19cd01b861c24bd009702ee86ac09f22
SHA512 c98c85c9ebddf1992c8bd9c4ecc68a506a8a4155b0c88e6dda9e91d68abd9bf3c88be874126e040197c8fb33c115802cbd395ca728ba345826b9b9d47c580e5f
SSDEEP 3072:1yBCUiOORPXgjDnq8SipzVSICOMRrQBVFi7SHt:sqIDnq8Fp5SxPRrTe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

danabot

Attributes

embedded_hash
F11D3871631E16E8DE15C24B32328D98
type
loader

Targets

- Target
  file.exe
- Size 133KB
- SHA256 3d9dbb946b996fcaa77c720d34d651eacea52c92c97ef584aa32baeaa958a29d
- MD5 1d5f250555d810f4659a579027fa9323
- SHA1 a330193d19cd01b861c24bd009702ee86ac09f22
- SHA512 c98c85c9ebddf1992c8bd9c4ecc68a506a8a4155b0c88e6dda9e91d68abd9bf3c88be874126e040197c8fb33c115802cbd395ca728ba345826b9b9d47c580e5f
- SSDEEP 3072:1yBCUiOORPXgjDnq8SipzVSICOMRrQBVFi7SHt:sqIDnq8Fp5SxPRrTe
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

smokeloader backdoor trojan danabot banker
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects Smokeloader packer

SmokeLoader

Downloads MZ/PE file

Executes dropped EXE

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2