danabot

General

Target
file.exe
Size 302KB
Sample221012-vt9jpsdbe6
SHA256 ea5a00b8a983adb9e938e18782a020a849c6c2d8ec6c33965fef493f2922f4b6
MD5 5c58750a964c33c83f0a362dd2fc978c
SHA1 a5a1ef6a826978210d05540e13a21e5e25f335ed
SHA512 c391bfe6967ca3a8b4a325a044cc0a45911c39a1efe02fedfcf72846ec485129d8a3d83044a3021ab218807d4f23d6945c974776229d6bdd69958a34af9ce8ea
SSDEEP 6144:nSHUWH4CFpyUM4oWiNh0QuEkye3weigavwVf:nXWhFpdM4vQh0EeAT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

danabot

Attributes

embedded_hash
56951C922035D696BFCE443750496462
type
loader

Targets

- Target
  file.exe
- Size 302KB
- SHA256 ea5a00b8a983adb9e938e18782a020a849c6c2d8ec6c33965fef493f2922f4b6
- MD5 5c58750a964c33c83f0a362dd2fc978c
- SHA1 a5a1ef6a826978210d05540e13a21e5e25f335ed
- SHA512 c391bfe6967ca3a8b4a325a044cc0a45911c39a1efe02fedfcf72846ec485129d8a3d83044a3021ab218807d4f23d6945c974776229d6bdd69958a34af9ce8ea
- SSDEEP 6144:nSHUWH4CFpyUM4oWiNh0QuEkye3weigavwVf:nXWhFpdM4vQh0EeAT
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

smokeloader backdoor trojan danabot banker
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects Smokeloader packer

SmokeLoader

Downloads MZ/PE file

Executes dropped EXE

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2