danabot | 43157b2d302a8a1baff450e8c67af7b41f62edad8aa68adffbd6aa6ef0cbbc24 | Triage

Submit
Reports

Overview

overview

Static

static

dridex

windows10-2004-x64

Sharing

General

Target

43157b2d302a8a1baff450e8c67af7b41f62edad8aa68adffbd6aa6ef0cbbc24
Size

214KB
Sample

221218-c1sknadd4x
MD5

1021f84c8752ea79512272424205566a
SHA1

48276be4e6429b8920bb9aa2de0b9bedfe8dc399
SHA256

43157b2d302a8a1baff450e8c67af7b41f62edad8aa68adffbd6aa6ef0cbbc24
SHA512

a9db622055e96348a40957f4c13543b5b8f13a6a2a9526082d37edaa504de2c7b95128570235eb20d6aecc2ee6b4ebef7d4101cac11eaf33d53141bb18691ecc
SSDEEP

3072:kl8mcsFLPYpZwRyxg9qaLt4L0OmjPxwiB1ts8/g3xoSckkFyG3ERWR3LV:a8mZFLPYpdC9SL5uP/pg3Ctk4U0VB

Score

10^/10

danabot smokeloader backdoor banker trojan

Static task

static1

Behavioral task

behavioral1

Sample

43157b2d302a8a1baff450e8c67af7b41f62edad8aa68adffbd6aa6ef0cbbc24.exe

Resource

win10v2004-20220812-en

danabot smokeloader backdoor banker trojan

windows10-2004-x64

22 signatures

150 seconds

Malware Config

Extracted

Family

danabot

C2

23.236.181.126:443

123.253.35.251:443

66.85.173.3:443

Attributes

embedded_hash
06BD317F4F9CFA75DD0DF0D5CD9B06A1
type
loader

Targets

- Target
  
  43157b2d302a8a1baff450e8c67af7b41f62edad8aa68adffbd6aa6ef0cbbc24
- Size
  
  214KB
- MD5
  
  1021f84c8752ea79512272424205566a
- SHA1
  
  48276be4e6429b8920bb9aa2de0b9bedfe8dc399
- SHA256
  
  43157b2d302a8a1baff450e8c67af7b41f62edad8aa68adffbd6aa6ef0cbbc24
- SHA512
  
  a9db622055e96348a40957f4c13543b5b8f13a6a2a9526082d37edaa504de2c7b95128570235eb20d6aecc2ee6b4ebef7d4101cac11eaf33d53141bb18691ecc
- SSDEEP
  
  3072:kl8mcsFLPYpZwRyxg9qaLt4L0OmjPxwiB1ts8/g3xoSckkFyG3ERWR3LV:a8mZFLPYpdC9SL5uP/pg3Ctk4U0VB
Score

10^/10

danabot smokeloader backdoor banker trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

danabotsmokeloaderbackdoorbankertrojan

© 2018-2024

Terms | Privacy