danabot

General

Target
file.exe
Size 274KB
Sample221012-abftfscacp
SHA256 5836ed313cfd6d3a7cb7c9bf1bd5f8a0d19ff815f66f8a8ab3427319d94db086
MD5 06896273843b2f4ecde48be12c09eb9b
SHA1 12983aaa22f80d3fb3bf362b0d09a184c9ee6c0e
SHA512 2015ad1115d2d06c19c6f369bec682139c0d2f34c462fe877580bf69469970a54458b2c8c4b61b113e1fb52ef452c555e4ed4483416c48bcb5c59c315c5876d9
SSDEEP 6144:eh73vOOir4AsvROs+rksrndSrwVfquSw:KqO/AsvYdSd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

danabot

Attributes

embedded_hash
56951C922035D696BFCE443750496462
type
loader

Targets

- Target
  file.exe
- Size 274KB
- SHA256 5836ed313cfd6d3a7cb7c9bf1bd5f8a0d19ff815f66f8a8ab3427319d94db086
- MD5 06896273843b2f4ecde48be12c09eb9b
- SHA1 12983aaa22f80d3fb3bf362b0d09a184c9ee6c0e
- SHA512 2015ad1115d2d06c19c6f369bec682139c0d2f34c462fe877580bf69469970a54458b2c8c4b61b113e1fb52ef452c555e4ed4483416c48bcb5c59c315c5876d9
- SSDEEP 6144:eh73vOOir4AsvROs+rksrndSrwVfquSw:KqO/AsvYdSd
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

smokeloader backdoor trojan danabot banker
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects Smokeloader packer

SmokeLoader

Downloads MZ/PE file

Executes dropped EXE

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2