danabot

General

Target
file.exe
Size 264KB
Sample221004-y7txyscdd6
SHA256 dbcda4bc5f7d98fee706f0ecb73e96397652d5d7c62c5c754ffcda96cb49282c
MD5 636691f07eb964d033adab95b06f4499
SHA1 1b318058e779805be6a88d170bcf6af26b52c954
SHA512 2cb23d7168f41256b44f2618c641706708078c746dc654d509eb86cd3b047bba2b052060f15964dbde1701830e2cce123487bab0d277c286881e8df3a1722b3b
SSDEEP 6144:/imrkNLxLgFulRoVmTWYcp2nTfSuzbgwun6twwVf://rkNtLgF+RoYTBa6TKunn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

danabot

Attributes

embedded_hash
EAD30BF58E340E9E105B328F524565E0
type
loader

Targets

- Target
  file.exe
- Size 264KB
- SHA256 dbcda4bc5f7d98fee706f0ecb73e96397652d5d7c62c5c754ffcda96cb49282c
- MD5 636691f07eb964d033adab95b06f4499
- SHA1 1b318058e779805be6a88d170bcf6af26b52c954
- SHA512 2cb23d7168f41256b44f2618c641706708078c746dc654d509eb86cd3b047bba2b052060f15964dbde1701830e2cce123487bab0d277c286881e8df3a1722b3b
- SSDEEP 6144:/imrkNLxLgFulRoVmTWYcp2nTfSuzbgwun6twwVf://rkNtLgF+RoYTBa6TKunn
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

smokeloader backdoor trojan danabot banker
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects Smokeloader packer

SmokeLoader

Downloads MZ/PE file

Executes dropped EXE

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2