General
-
Target
2e8e88f58fb4c7da24306fd380311303af8e61dae5211497d9a340e74b82d2a1
-
Size
255KB
-
Sample
221025-x3cx7sdfdm
-
MD5
1118c9d04c38cd478a32fed3a4eb0a0c
-
SHA1
f77826496b896713b28a99f86550c0c1ecff1a76
-
SHA256
2e8e88f58fb4c7da24306fd380311303af8e61dae5211497d9a340e74b82d2a1
-
SHA512
02d7f5b1c9dd901337086510fe5306cf9112f3ef7c8da351945dd442fc21885cfc28d92ec1163a87f195f593606e5f6b44dc9d15a010ac6ff5ac25b3fb716e31
-
SSDEEP
3072:sPXV/3C++LvSG8aq8KFsjR2/ytn8qmXyJdVcQA2QAvI+IsgrwUY6hzUT:EE3LPpq8KF1TqvBGOE7rwUlzUT
Static task
static1
Malware Config
Extracted
danabot
-
embedded_hash
BBBB0DB8CB7E6D152424535822E445A7
-
type
loader
Extracted
vidar
55.2
937
https://t.me/slivetalks
https://c.im/@xinibin420
-
profile_id
937
Targets
-
-
Target
2e8e88f58fb4c7da24306fd380311303af8e61dae5211497d9a340e74b82d2a1
-
Size
255KB
-
MD5
1118c9d04c38cd478a32fed3a4eb0a0c
-
SHA1
f77826496b896713b28a99f86550c0c1ecff1a76
-
SHA256
2e8e88f58fb4c7da24306fd380311303af8e61dae5211497d9a340e74b82d2a1
-
SHA512
02d7f5b1c9dd901337086510fe5306cf9112f3ef7c8da351945dd442fc21885cfc28d92ec1163a87f195f593606e5f6b44dc9d15a010ac6ff5ac25b3fb716e31
-
SSDEEP
3072:sPXV/3C++LvSG8aq8KFsjR2/ytn8qmXyJdVcQA2QAvI+IsgrwUY6hzUT:EE3LPpq8KF1TqvBGOE7rwUlzUT
-
Detects Smokeloader packer
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Deletes itself
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-