danabot

General

Target

76bf0e526260acf427746a3070bcb9a920dbadd0023a7829f793ea2b57ef7a5d
Size

220KB
Sample

221025-ds8gksbdf3
MD5

4d1eb7b9e286dbb9f82ae958c3bb2394
SHA1

8e8458e39b6723f16b686c4d1eac60b3020d8efb
SHA256

76bf0e526260acf427746a3070bcb9a920dbadd0023a7829f793ea2b57ef7a5d
SHA512

63e06f58d55ca9d1ac96310b64d2e2cf8fb5a82768124846363e98eaafbc4c46c15a5f61ab22e0958a2edf15043b1fc404adc521dc99ca69e5f3e90c61676b6c
SSDEEP

3072:O5nP5d84THy2ULgJWwp635aAHy+1IsCZIAE3501ARhzGjvbQZ:O5PInLYpNfPsCqVIARha

Score

10^/10

Malware Config

Extracted

Family

danabot

Attributes

embedded_hash
569235DCA8F16ED8310BBACCB674F896
type
loader

Extracted

Family

vidar

Version

55.2

Botnet

937

C2

https://t.me/slivetalks

https://c.im/@xinibin420

Attributes

profile_id
937

Targets

- Target
  
  76bf0e526260acf427746a3070bcb9a920dbadd0023a7829f793ea2b57ef7a5d
- Size
  
  220KB
- MD5
  
  4d1eb7b9e286dbb9f82ae958c3bb2394
- SHA1
  
  8e8458e39b6723f16b686c4d1eac60b3020d8efb
- SHA256
  
  76bf0e526260acf427746a3070bcb9a920dbadd0023a7829f793ea2b57ef7a5d
- SHA512
  
  63e06f58d55ca9d1ac96310b64d2e2cf8fb5a82768124846363e98eaafbc4c46c15a5f61ab22e0958a2edf15043b1fc404adc521dc99ca69e5f3e90c61676b6c
- SSDEEP
  
  3072:O5nP5d84THy2ULgJWwp635aAHy+1IsCZIAE3501ARhzGjvbQZ:O5PInLYpNfPsCqVIARha
Score

10^/10

danabot smokeloader vidar 937 backdoor banker discovery spyware stealer trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1