General
-
Target
6a5cf3c99efc1c7ba905caf3a7af8d96ff23399ddf17b1bce65c7a87f67bf46f
-
Size
260KB
-
Sample
221027-madzpabgf2
-
MD5
1192b8a910b8b5514317e7cb99644cbb
-
SHA1
99ff20cb017f1010ece81ea0ac558c11c98cd731
-
SHA256
6a5cf3c99efc1c7ba905caf3a7af8d96ff23399ddf17b1bce65c7a87f67bf46f
-
SHA512
98afbd90b46057d2b7d54cc0684c66050d615a4b2994d4afbeb2744a4c8c296caa168a76bbfecac3b1313eb1ef568f17cefec971f9efd2cd928594fa7f5b5ad7
-
SSDEEP
3072:+XKQEDgkW0MataObS5zlrciicAaO90PKFIagWYtHi+RpR20Kc:GhgMTataOeldkIe+5pI0
Static task
static1
Malware Config
Extracted
danabot
172.86.120.215:443
213.227.155.103:443
103.187.26.147:443
172.86.120.138:443
-
embedded_hash
BBBB0DB8CB7E6D152424535822E445A7
-
type
loader
Extracted
systembc
45.182.189.231:443
Targets
-
-
Target
6a5cf3c99efc1c7ba905caf3a7af8d96ff23399ddf17b1bce65c7a87f67bf46f
-
Size
260KB
-
MD5
1192b8a910b8b5514317e7cb99644cbb
-
SHA1
99ff20cb017f1010ece81ea0ac558c11c98cd731
-
SHA256
6a5cf3c99efc1c7ba905caf3a7af8d96ff23399ddf17b1bce65c7a87f67bf46f
-
SHA512
98afbd90b46057d2b7d54cc0684c66050d615a4b2994d4afbeb2744a4c8c296caa168a76bbfecac3b1313eb1ef568f17cefec971f9efd2cd928594fa7f5b5ad7
-
SSDEEP
3072:+XKQEDgkW0MataObS5zlrciicAaO90PKFIagWYtHi+RpR20Kc:GhgMTataOeldkIe+5pI0
-
Detects Smokeloader packer
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-