danabot

General

Target
file.exe
Size 224KB
Sample221022-pmspqadccn
SHA256 ef031ae3787a3ab2fc2dcfde2857913c0f933fc29539462d174e132d314089ca
MD5 8092d774d75f40c5516292e1262bac98
SHA1 3954676f9d4da485713d5d3dd62a3bcba806080c
SHA512 b955732f70d5b06bc6599d68ade56af73b107156a68333f2ab188e3173d3d2fd6063831bf4ca9575fa77b6748c6f4eff142da9c5de672c294f629141294aacde
SSDEEP 3072:IXCLL7BR02Xy5Jy6i1cMrX7w3dtKKKK6UKoYKb0eyYGYTrt97Hi5tAAx:coLjNX7ridEheJi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

danabot

C2

49.0.50.0:57
51.0.52.0:0
53.0.54.0:1200
55.0.56.0:65535

Attributes

embedded_hash
8D3A926FD67FCDCACD5CC640026959E5
type
loader

Targets

- Target
  file.exe
- Size 224KB
- SHA256 ef031ae3787a3ab2fc2dcfde2857913c0f933fc29539462d174e132d314089ca
- MD5 8092d774d75f40c5516292e1262bac98
- SHA1 3954676f9d4da485713d5d3dd62a3bcba806080c
- SHA512 b955732f70d5b06bc6599d68ade56af73b107156a68333f2ab188e3173d3d2fd6063831bf4ca9575fa77b6748c6f4eff142da9c5de672c294f629141294aacde
- SSDEEP 3072:IXCLL7BR02Xy5Jy6i1cMrX7w3dtKKKK6UKoYKb0eyYGYTrt97Hi5tAAx:coLjNX7ridEheJi
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

smokeloader backdoor trojan danabot banker
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects Smokeloader packer

SmokeLoader

Downloads MZ/PE file

Executes dropped EXE

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2