danabot

General

Target
file.exe
Size 218KB
Sample221021-r5vm5sfef4
SHA256 eea899d2674e15f70cc95dd8a2d5e3dc883b709b84e6bcd6d953a6e1d5bfb64f
MD5 3a9ce5523db8a26e556d8e12888036ff
SHA1 c24294b2740557558f11518c1246f4dff4eff1e9
SHA512 e35d7360afcad3034e5c6ed278941d2719461d2cce43604e22e29431eb52b0000fbfd423587ca8bf9722848f5c2a40804610c94b2a3392d0dabd86a4fc03f6f1
SSDEEP 6144:DnJLO+0QotZlS6Txu9EEC6o/NewrI7id:DnJi+VorDT8eEC6MewE7i
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

danabot

Attributes

embedded_hash
4914AD1B39A63A7A98AA0D63EE31F9A9
type
loader

Targets

- Target
  file.exe
- Size 218KB
- SHA256 eea899d2674e15f70cc95dd8a2d5e3dc883b709b84e6bcd6d953a6e1d5bfb64f
- MD5 3a9ce5523db8a26e556d8e12888036ff
- SHA1 c24294b2740557558f11518c1246f4dff4eff1e9
- SHA512 e35d7360afcad3034e5c6ed278941d2719461d2cce43604e22e29431eb52b0000fbfd423587ca8bf9722848f5c2a40804610c94b2a3392d0dabd86a4fc03f6f1
- SSDEEP 6144:DnJLO+0QotZlS6Txu9EEC6o/NewrI7id:DnJi+VorDT8eEC6MewE7i
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

smokeloader backdoor trojan danabot banker
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects Smokeloader packer

SmokeLoader

Downloads MZ/PE file

Executes dropped EXE

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2