danabot

General

Target
file.exe
Size 266KB
Sample221004-sbkrhsbfbj
SHA256 234c747d70afbcecded90db4e715e77ffaa233c461820dc687b054ed7966bd0c
MD5 e2772afbbdac726fe0710010f9eebd0f
SHA1 934632fc9f8a69d5dae63a071c769334e743a182
SHA512 c9c65f45b767ddccb9f882b699570770f018bd88222ef8aa48a9b64a6857bbc2f5e0b3bf27891a0ea5ef9bab2a47580ab125b10fa62eb22b1375115752cf961b
SSDEEP 3072:0XhA49L/ILDtASaGgn6L445URBD/mg4aRuLpKq5EWrxpzbgqru6YupZa9uD6Vdyo:w7SLsn6WRBDjhR6L5Euzbgwu6XwVfh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

danabot

Attributes

embedded_hash
EAD30BF58E340E9E105B328F524565E0
type
loader

Targets

- Target
  file.exe
- Size 266KB
- SHA256 234c747d70afbcecded90db4e715e77ffaa233c461820dc687b054ed7966bd0c
- MD5 e2772afbbdac726fe0710010f9eebd0f
- SHA1 934632fc9f8a69d5dae63a071c769334e743a182
- SHA512 c9c65f45b767ddccb9f882b699570770f018bd88222ef8aa48a9b64a6857bbc2f5e0b3bf27891a0ea5ef9bab2a47580ab125b10fa62eb22b1375115752cf961b
- SSDEEP 3072:0XhA49L/ILDtASaGgn6L445URBD/mg4aRuLpKq5EWrxpzbgqru6YupZa9uD6Vdyo:w7SLsn6WRBDjhR6L5Euzbgwu6XwVfh
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

smokeloader backdoor trojan danabot banker
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects Smokeloader packer

SmokeLoader

Downloads MZ/PE file

Executes dropped EXE

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2