General

  • Target

    file.exe

  • Size

    145KB

  • Sample

    221006-cg9d3agchj

  • MD5

    c2d30d40b50bec8ee031fe4a8b27ef51

  • SHA1

    4250bea1bc8eb050c1b577cfbcac832837a29051

  • SHA256

    88d3e851f01640e8ac2482f640d912bff0773d375947aae29e349cef657f2cad

  • SHA512

    7bb7d8f347acc3e2754c06f4f8220031feb1796bc8c81678f2b31e979c431a74227664ee1bc30a65c183eb6917bda3a34a7f77e44e3c3048b6eb876146ba7693

  • SSDEEP

    3072:x9lPkhN7hfvSqR0mxgRUTDZc7G2zq92oU1q2XCR+O:b6JOqRAGvPUIICs

Malware Config

Extracted

Family

danabot

Attributes
  • embedded_hash

    EAD30BF58E340E9E105B328F524565E0

  • type

    loader

Targets

    • Target

      file.exe

    • Size

      145KB

    • MD5

      c2d30d40b50bec8ee031fe4a8b27ef51

    • SHA1

      4250bea1bc8eb050c1b577cfbcac832837a29051

    • SHA256

      88d3e851f01640e8ac2482f640d912bff0773d375947aae29e349cef657f2cad

    • SHA512

      7bb7d8f347acc3e2754c06f4f8220031feb1796bc8c81678f2b31e979c431a74227664ee1bc30a65c183eb6917bda3a34a7f77e44e3c3048b6eb876146ba7693

    • SSDEEP

      3072:x9lPkhN7hfvSqR0mxgRUTDZc7G2zq92oU1q2XCR+O:b6JOqRAGvPUIICs

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Downloads MZ/PE file

    • Executes dropped EXE

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

Tasks