General
-
Target
eb261ac1f524d2fd887a90a8fd8548ad53733488d4ea2cee84766183c4f0d09e
-
Size
256KB
-
Sample
221025-tkxywadbd2
-
MD5
a640798be08430163307e6a2cb725a32
-
SHA1
be06cfde2534316573eb49ee69eefb79ef1527ea
-
SHA256
eb261ac1f524d2fd887a90a8fd8548ad53733488d4ea2cee84766183c4f0d09e
-
SHA512
211e0eaf90917b12426d67a02161a1b2a250e9a0c8d9f0b47646c8cbe51a8d6fabaf89b05d424b6728d043960efcfc9d035c1e350759e2aa40070f2d42c71fde
-
SSDEEP
3072:OXVmUu5QfLESPjSPlKjYb8ERW48rhXCv+S/AcWR7woRbSf9NJlZ0r5Yk16Ju:WA9wLjuPlKjYb8L3CWSIcMBR+9l4584
Static task
static1
Malware Config
Extracted
danabot
-
embedded_hash
569235DCA8F16ED8310BBACCB674F896
-
type
loader
Extracted
vidar
55.2
937
https://t.me/slivetalks
https://c.im/@xinibin420
-
profile_id
937
Targets
-
-
Target
eb261ac1f524d2fd887a90a8fd8548ad53733488d4ea2cee84766183c4f0d09e
-
Size
256KB
-
MD5
a640798be08430163307e6a2cb725a32
-
SHA1
be06cfde2534316573eb49ee69eefb79ef1527ea
-
SHA256
eb261ac1f524d2fd887a90a8fd8548ad53733488d4ea2cee84766183c4f0d09e
-
SHA512
211e0eaf90917b12426d67a02161a1b2a250e9a0c8d9f0b47646c8cbe51a8d6fabaf89b05d424b6728d043960efcfc9d035c1e350759e2aa40070f2d42c71fde
-
SSDEEP
3072:OXVmUu5QfLESPjSPlKjYb8ERW48rhXCv+S/AcWR7woRbSf9NJlZ0r5Yk16Ju:WA9wLjuPlKjYb8L3CWSIcMBR+9l4584
-
Detects Smokeloader packer
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-