danabot

General

Target
file.exe
Size 273KB
Sample221012-d5w93sccel
SHA256 aa59afc83e3df6e364a0561fd074dd5e2f4190ae119faf07bf6a5433d7f2eef2
MD5 e11ed3b4bace5d69ea1f648e0fb145eb
SHA1 eee39f4e5273559c7740ae63865e08f570ba0cb8
SHA512 3fd0164ffb353144942ecd6abc34836e7ba2fb94f3a3360184304e3e26637017c9cbee7abd54eaf84ba57cb9215e4243fdf776bdacd5b1ae441ec356d1268836
SSDEEP 6144:Xe7rdhIirWSg+bkKJ4AQk/cfBFrwVfquSE:OPIGgMPJN/cfd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

danabot

Attributes

embedded_hash
56951C922035D696BFCE443750496462
type
loader

Targets

- Target
  file.exe
- Size 273KB
- SHA256 aa59afc83e3df6e364a0561fd074dd5e2f4190ae119faf07bf6a5433d7f2eef2
- MD5 e11ed3b4bace5d69ea1f648e0fb145eb
- SHA1 eee39f4e5273559c7740ae63865e08f570ba0cb8
- SHA512 3fd0164ffb353144942ecd6abc34836e7ba2fb94f3a3360184304e3e26637017c9cbee7abd54eaf84ba57cb9215e4243fdf776bdacd5b1ae441ec356d1268836
- SSDEEP 6144:Xe7rdhIirWSg+bkKJ4AQk/cfBFrwVfquSE:OPIGgMPJN/cfd
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

smokeloader backdoor trojan danabot banker
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects Smokeloader packer

SmokeLoader

Downloads MZ/PE file

Executes dropped EXE

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2